Skip to content

Instantly share code, notes, and snippets.

@D4R4

D4R4/.htaccess

Created March 10, 2023 11:53
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save D4R4/4081c5ff31ec0e6cd48293b1e915f652 to your computer and use it in GitHub Desktop.
Save D4R4/4081c5ff31ec0e6cd48293b1e915f652 to your computer and use it in GitHub Desktop.
Download ZIP
Here's the htaccess code to allow everything in CSP
Raw
.htaccess
<ifModule mod_headers.c>
Header set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" env=HTTPS
Header set X-XSS-Protection "1; mode=block"
Header set X-Content-Type-Options nosniff
Header set X-Frame-Options DENY
Header add Content-Security-Policy "default-src * data: blob: filesystem: about: ws: wss: 'unsafe-inline' 'unsafe-eval' 'unsafe-dynamic'; script-src * data: blob: 'unsafe-inline' 'unsafe-eval'; connect-src * data: blob: 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src * data: blob: ; style-src * data: blob: 'unsafe-inline'; font-src * data: blob: 'unsafe-inline';"
</ifModule>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment