diff options
| author | Feross Aboukhadijeh <feross@feross.org> | 2019-08-27 23:50:19 +0300 |
|---|---|---|
| committer | Feross Aboukhadijeh <feross@feross.org> | 2019-08-27 23:50:19 +0300 |
| commit | 9029557ca3d22faef67315f8ed33df295ce6d59e (patch) | |
| tree | b2445afdb02d50fe92a723ddf8769077296aff02 /lib/server.js | |
| parent | cdf1159cc0227b1f85c4a52263cbd33bc4ed5242 (diff) | |
Address @diracdeltas feedback on #1714
Diffstat (limited to 'lib/server.js')
| -rw-r--r-- | lib/server.js | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/lib/server.js b/lib/server.js index c8a5488..9fb725d 100644 --- a/lib/server.js +++ b/lib/server.js @@ -88,7 +88,7 @@ function Server (torrent, opts = {}) { res.setHeader('X-Content-Type-Options', 'nosniff') // Defense-in-depth: Set a strict Content Security Policy to mitigate XSS - res.setHeader('Content-Security-Policy', "base-uri 'none'; default-src 'none'; frame-ancestors 'none'; object-src 'none';") + res.setHeader('Content-Security-Policy', "base-uri 'none'; default-src 'none'; frame-ancestors 'none'; form-action 'none';") if (pathname === '/favicon.ico') { return serve404Page() |