mirror of
https://github.com/Part-DB/Part-DB-server.git
synced 2025-06-20 17:15:51 +02:00
73 lines
No EOL
2.3 KiB
YAML
73 lines
No EOL
2.3 KiB
YAML
nelmio_security:
|
|
# prevents framing of the entire site
|
|
clickjacking:
|
|
paths:
|
|
'^/.*': SAMEORIGIN
|
|
|
|
# disables content type sniffing for script resources
|
|
content_type:
|
|
nosniff: true
|
|
|
|
# prevents redirections outside the website's domain
|
|
external_redirects:
|
|
abort: true
|
|
log: true
|
|
allow_list:
|
|
# Whitelist the domain of the SAML IDP, so we can redirect to it during the SAML login process
|
|
- '%env(string:key:host:url:SAML_IDP_SINGLE_SIGN_ON_SERVICE)%'
|
|
|
|
# Whitelist the info provider APIs (OAuth redirects)
|
|
- 'digikey.com'
|
|
- 'nexar.com'
|
|
|
|
# forces Microsoft's XSS-Protection with
|
|
# its block mode
|
|
xss_protection:
|
|
enabled: true
|
|
mode_block: true
|
|
|
|
# Send a full URL in the `Referer` header when performing a same-origin request,
|
|
# only send the origin of the document to secure destination (HTTPS->HTTPS),
|
|
# and send no header to a less secure destination (HTTPS->HTTP).
|
|
# If `strict-origin-when-cross-origin` is not supported, use `no-referrer` policy,
|
|
# no referrer information is sent along with requests.
|
|
referrer_policy:
|
|
enabled: true
|
|
policies:
|
|
- 'no-referrer'
|
|
- 'strict-origin-when-cross-origin'
|
|
|
|
csp:
|
|
enabled: true
|
|
hosts: [ ]
|
|
content_types: [ ]
|
|
enforce:
|
|
level1_fallback: false
|
|
browser_adaptive:
|
|
enabled: false
|
|
report-uri: '%router.request_context.base_url%/csp/report'
|
|
default-src:
|
|
- 'self'
|
|
img-src:
|
|
- '*'
|
|
- 'data:'
|
|
style-src:
|
|
- 'self'
|
|
- 'unsafe-inline'
|
|
- 'data:'
|
|
script-src:
|
|
- 'self'
|
|
object-src:
|
|
- 'self'
|
|
- 'data:'
|
|
frame-src:
|
|
- 'self'
|
|
- 'data:'
|
|
block-all-mixed-content: true # defaults to false, blocks HTTP content over HTTPS transport
|
|
# upgrade-insecure-requests: true # defaults to false, upgrades HTTP requests to HTTPS transport
|
|
|
|
when@dev:
|
|
# disables the Content-Security-Policy header
|
|
nelmio_security:
|
|
csp:
|
|
enabled: false |