|
Header set Content-Security-Policy "default-src data: blob: 'self' *.apache.org *.githubusercontent.com *.hub.lumenfield.work *.algolia.net *.algolianet.com *.apachecon.com *.communityovercode.org 'unsafe-inline' 'unsafe-eval'; frame-src 'self' data: blob:; frame-ancestors 'self'; worker-src 'self' data: blob:; img-src 'self' blob: data: https: *.apache.org www.apachecon.com; style-src 'self' 'unsafe-inline' data:;" |
The Content-Security-Policy header must not be overridden.
There is now a standard way to add local exceptions to the CSP:
https://infra.apache.org/tools/csp.html
You need to get approval before adding any domains. Also please document such approval in the .htaccess file.
The following are already included in the default:
https://www.apachecon.com/
https://www.communityovercode.org/
https://*.apache.org/
https://apache.org/
https://*.scarf.sh/
tsfile/src/.vuepress/public/.htaccess
Line 9 in 054e8a3
The Content-Security-Policy header must not be overridden.
There is now a standard way to add local exceptions to the CSP:
https://infra.apache.org/tools/csp.html
You need to get approval before adding any domains. Also please document such approval in the .htaccess file.
The following are already included in the default: