bookstack

Commit Graph

Author	SHA1	Message	Date
Dan Brown	253f386f00	Finished off script CSP rules - Added caching for custom html head parsing to add nonce. - Also moved api docs page into web routes to prevent issues.	2021-09-04 13:57:04 +01:00
Dan Brown	934a833818	Apply fixes from StyleCI	2021-06-26 15:23:15 +00:00
Dan Brown	92922288dd	Added iframe CSP, improved session cookie security Added iframe CSP headers with configuration via .env. Updated session cookies to be lax by default, dynamically changing to none when iframes configured to allow third-party control. Updated cookie security to be auto-secure if a https APP_URL is set. Related to #2427 and #2207.	2021-01-02 02:43:50 +00:00

Author

SHA1

Message

Date

Dan Brown

253f386f00

Finished off script CSP rules

- Added caching for custom html head parsing to add nonce.
- Also moved api docs page into web routes to prevent issues.

2021-09-04 13:57:04 +01:00

Dan Brown

934a833818

Apply fixes from StyleCI

2021-06-26 15:23:15 +00:00

Dan Brown

92922288dd

Added iframe CSP, improved session cookie security

Added iframe CSP headers with configuration via .env.
Updated session cookies to be lax by default, dynamically changing to
none when iframes configured to allow third-party control.
Updated cookie security to be auto-secure if a https APP_URL is set.

Related to #2427 and #2207.

2021-01-02 02:43:50 +00:00

3 Commits