mirrors/hedgedoc
1
0
Fork 0
mirror of https://github.com/hedgedoc/hedgedoc.git synced 2025-05-14 15:14:56 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions

CSP: Upgrade insecure requests if possible

Browse source 
Config option; default is to only upgrade if usessl
This commit is contained in:
Literallie 2017-10-18 17:45:57 +02:00
parent ba183ce654
commit 5d2d3ec875
No known key found for this signature in database
GPG key ID: 7BE463C902ED152C
2 changed files with 8 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

5
app.js
View file

@ -126,6 +126,11 @@ if (config.csp.enable) {
directives[propertyName] = directive;
}
}
if(config.csp.upgradeInsecureRequests === 'auto') {
directives.upgradeInsecureRequests = config.usessl === 'true'
} else {
directives.upgradeInsecureRequests = config.csp.upgradeInsecureRequests === 'true'
}
app.use(helmet.contentSecurityPolicy({
directives: directives
}))