deepStateMirrors/tabi
1
0
Fork 1
mirror of https://github.com/welpo/tabi.git synced 2025-10-11 07:46:15 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

🔒️ fix(header): reposition include of CSP partial

Browse source 
Per the CSP spec on delivering policy using the meta element
https://www.w3.org/TR/CSP/#meta-element):

> Authors are strongly encouraged to place meta elements as early in
> the document as possible, because policies in meta elements are not
> applied to content which precedes them. In particular, note that
> resources fetched or prefetched using the Link HTTP response header
> field, and resources fetched or prefetched using link and script
> elements which precede a meta-delivered policy will not be blocked.

Move the CSP close to the top of <head> to protect additional resources.
This commit is contained in:
Stephen Kershaw 2025-01-25 14:11:10 +00:00
parent 6445f549ad
commit f50cef1984
No known key found for this signature in database
1 changed files with 5 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

9
templates/partials/header.html
View file

@ -1,5 +1,10 @@
<head>
<meta charset="UTF-8">
{%- if macros_settings::evaluate_setting_priority(setting="enable_csp", page=page | default(value=""), section=section | default(value=""), default_global_value="true") == "true" -%}
{%- include "partials/content_security_policy.html" -%}
{%- endif -%}
<meta name="viewport" content="width=device-width, initial-scale=1.0">
<meta name="base" content="{{ config.base_url | safe }}">
@ -130,10 +135,6 @@
<meta property="og:site_name" content="{{ config.title }}">
{%- if macros_settings::evaluate_setting_priority(setting="enable_csp", page=page | default(value=""), section=section | default(value=""), default_global_value="true") == "true" -%}
{%- include "partials/content_security_policy.html" -%}
{%- endif -%}
{%- if config.extra.theme_switcher and config.extra.theme_switcher == true -%}
{# If JavaScript is disabled, hide the button. #}
<noscript><link rel="stylesheet" href="{{ get_url(path='no_js.css') | safe }}"/></noscript>