enable CSP headers

Codepoints · Feb 29, 2024 · 22f6e05 · 22f6e05
1 parent 58d9330
commit 22f6e05
Showing 1 changed file with 11 additions and 0 deletions.
diff --git a/codepoints.net/index.php b/codepoints.net/index.php
@@ -21,6 +21,17 @@
  */
 header('Permissions-Policy: interest-cohort=()');
 
+/**
+ * enable CSP protection (reporting only for now)
+ */
+header('Content-Security-Policy-Report-Only: '.
+    'default-src \'self\' https://stats.codepoints.net:443; '.
+    'style-src \'self\' \'unsafe-inline\'; '.
+    'font-src \'self\'; '.
+    (array_key_exists('embed', $_GET)? 'frame-ancestors *; ' : '').
+    'upgrade-insecure-requests; '.
+    'report-uri https://codepoints.report-uri.com/r/d/csp/reportOnly');
+
 /**
  * load the routes
  */