HTTP Content-Security-Policy header support
Currently to load lufi without error, need to use
## on https
add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline'; connect-src 'self' *; img-src 'self'; style-src 'self';";
## alternative on http
## FIXME! over http, CSP request for amazonaws, lancheck??? jquery? not impacting to refuse them
#add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' https://s3.amazonaws.com/js-static/ http://lancheck.net/metric/ ht tp://lancheck.net/optout/; connect-src 'self' *; img-src 'self' http://lancheck.net/metric/; style-src 'self' 'unsafe-inline';";
add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline'; connect-src 'self' *; img-src 'self'; style-src 'self' 'unsafe-inline';";
(nginx)
Ideally, javascript and style code can be moved to files to remove unsafe-inline (or use a SRI hash https://www.srihash.org/) and connect is only on self and not *. latter seems because of ws://self/upload, so not sure where it fails. 'connect-src ws://' doesn't help
Thanks