From e818bdd75f418ac0f6934a97ed2bb79dc6058241 Mon Sep 17 00:00:00 2001 From: Arve Knudsen Date: Fri, 22 Jan 2021 21:12:42 +0100 Subject: [PATCH] configuration.md: Document Content Security Policy options (#30413) Signed-off-by: Arve Knudsen --- docs/sources/administration/configuration.md | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/docs/sources/administration/configuration.md b/docs/sources/administration/configuration.md index 926a6e7d87a..9f6f62d82a6 100644 --- a/docs/sources/administration/configuration.md +++ b/docs/sources/administration/configuration.md @@ -508,6 +508,14 @@ Set to `true` to enable the X-Content-Type-Options response header. The X-Conten Set to `false` to disable the X-XSS-Protection header, which tells browsers to stop pages from loading when they detect reflected cross-site scripting (XSS) attacks. The default value is `false` until the next minor release, `6.3`. +### content_security_policy + +Set to `true` to add the Content-Security-Policy header to your requests. CSP allows to control resources that the user agent can load and helps prevent XSS attacks. + +### content_security_policy_template + +Set Content Security Policy template used when adding the Content-Security-Policy header to your requests. `$NONCE` in the template includes a random nonce. +
## [snapshots]