Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add Content-Security-Policy header to nginx config #434

Merged
merged 11 commits into from
Aug 13, 2024
Merged

Add Content-Security-Policy header to nginx config #434

Changes from 1 commit
Commits
Show all changes
11 commits
Select commit Hold shift + click to select a range
bf0cc89
Add Content-Security-Policy header to nginx config
Aug 12, 2024
ec51845
Try to use newer version of python for test workflow
Aug 13, 2024
515085b
Downgrade the setuptools version to install demjson
Aug 13, 2024
bd95051
Add wheel installation step
Aug 13, 2024
6c42fe5
Use ubuntu-20.04 for github action runner
Aug 13, 2024
fdd8cd5
Add trusted host workaround for tests workflow
Aug 13, 2024
c468f06
Freeze setuptools version to 57.4.0
Aug 13, 2024
ad85aaf
Use setuptools<58
Aug 13, 2024
446fab6
Use quotes for "setuptools<58"
Aug 13, 2024
82fbe2e
Add wheel installation
Aug 13, 2024
cd3d7f7
Revert workflow changes and update changelog
Aug 13, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 5 additions & 0 deletions playbooks/roles/nginx/templates/edx/app/nginx/sites-available/lms.j2
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -121,6 +121,11 @@ error_page {{ k }} {{ v }};
# prevent the browser from doing MIME-type sniffing
add_header X-Content-Type-Options nosniff;

{% if EDXAPP_LMS_IFRAME_ENABLED %}
# Allow iFrame for the provided hosts
add_header Content-Security-Policy "frame-ancestors 'self' {{ EDXAPP_LMS_FRAME-ANCESTORS }}";
{% endif %}

# Prevent invalid display courseware in IE 10+ with high privacy settings
add_header P3P '{{ NGINX_P3P_MESSAGE }}';

Expand Down
Loading