mirror of
https://git.sr.ht/~emersion/gamja
synced 2024-12-01 20:06:57 -05:00
e29ccf7220
Add a baseline CSP applicable to all gamja deployments. Resources can only be loaded from the current host, frames and objects are disallowed, and scripts are allowed to connect to any host (to allow cross-site WebSocket connections). If the server returns a different CSP via an HTTP header, the effective CSP will be the intersection.
17 lines
559 B
HTML
17 lines
559 B
HTML
<!DOCTYPE html>
|
|
<html>
|
|
<head>
|
|
<meta charset="utf-8">
|
|
<meta http-equiv="Content-Security-Policy" content="default-src 'self'; frame-src 'none'; object-src 'none'; connect-src *;">
|
|
<title>gamja IRC client</title>
|
|
<link rel="stylesheet" href="./style.css">
|
|
<script type="module" src="./main.js"></script>
|
|
<meta name="viewport" content="width=device-width, initial-scale=1">
|
|
<link rel="manifest" href="manifest.json">
|
|
</head>
|
|
<body>
|
|
<noscript>
|
|
<p>Unfortunately gamja requires JavaScript. Please enable it!</p>
|
|
</noscript>
|
|
</body>
|
|
</html>
|