updated api content security to make chrome more happy

NginxRocks · Jun 7, 2018 · 5777b9f · 5777b9f
1 parent e267768
commit 5777b9f
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/include/security/apicontentsecurity.conf b/include/security/apicontentsecurity.conf
@@ -6,7 +6,7 @@
 #     frame-src 'self' data: chrome-extension-resource:;
 #     font-src 'self' data: chrome-extension-resource:;
 #     media-src * data: blob: filesystem:;
-add_header Content-Security-Policy 'default-src self * unsafe-inline ; script-src * self unsafe-inline ; upgrade-insecure-requests;' always;
+add_header Content-Security-Policy 'default-src \'self\'; script-src * \'self\' \'unsafe-inline\'; style-src * \'self\' \'unsafe-inline\'; upgrade-insecure-requests;' always;
 
 add_header X-Frame-Options "SAMEORIGIN" always;
 add_header X-Content-Type-Options "nosniff" always;