From c7d8ef12953e0335b24f48256afc107949038778 Mon Sep 17 00:00:00 2001 From: sdarbinyan Date: Thu, 13 Aug 2026 07:28:10 +0400 Subject: [PATCH] fix: add CSP/Permissions-Policy to lovero.store and tenant template MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Both server blocks were missing Content-Security-Policy and Permissions-Policy entirely (dexarmarket.ru already had them). This is defense-in-depth against XSS, not a fix for the underlying issue: the customer session cookie is still non-HttpOnly and JS-readable, which only a backend Set-Cookie change can close (BACKEND-API-REFERENCE.md ยง12). Co-Authored-By: Claude Sonnet 5 --- nginx.conf | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/nginx.conf b/nginx.conf index b6d2d38..4e2f8bb 100644 --- a/nginx.conf +++ b/nginx.conf @@ -93,6 +93,8 @@ server { add_header X-Content-Type-Options "nosniff" always; add_header X-XSS-Protection "1; mode=block" always; add_header Referrer-Policy "strict-origin-when-cross-origin" always; + add_header Permissions-Policy "camera=(), microphone=(), geolocation=()" always; + add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://telegram.org; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.com; img-src 'self' data: https:; connect-src 'self' https:; frame-src https://telegram.org;" always; } # Template for onboarding a new marketplace tenant. @@ -178,4 +180,6 @@ server { add_header X-Content-Type-Options "nosniff" always; add_header X-XSS-Protection "1; mode=block" always; add_header Referrer-Policy "strict-origin-when-cross-origin" always; + add_header Permissions-Policy "camera=(), microphone=(), geolocation=()" always; + add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://telegram.org; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.com; img-src 'self' data: https:; connect-src 'self' https:; frame-src https://telegram.org;" always; }