mirror of
https://github.com/moparisthebest/xeps
synced 2024-12-12 19:02:16 -05:00
XEP-0363: Servers may want to sign headers
Signed-off-by: Maxime “pep” Buquet <pep@bouah.net>
This commit is contained in:
parent
bb41813924
commit
7bffc70203
@ -354,6 +354,7 @@ Content-Security-Policy: default-src 'none'; frame-ancestors 'none';
|
||||
]]></code>
|
||||
<p>The provided policy will prohibit a browser from executing all active content from the HTTP upload domain (<em>default-src 'none'</em>) and forbid embedding it from other pages (<em>frame-ancestors 'none'</em>). More information on Content-Security-Policy can be found on <link url="https://infosec.mozilla.org/guidelines/web_security#content-security-policy">infosec.mozilla.org</link>.</p>
|
||||
<p>Further isolation can be achieved by hosting those files on an entirely different domain instead of using subdomains.</p>
|
||||
<p>Headers may be signed so that receiving HTTP entities can verify these haven't been tempered with by clients.</p>
|
||||
</section2>
|
||||
<section2 topic="Uploader" anchor="uploader">
|
||||
<ul>
|
||||
|
Loading…
Reference in New Issue
Block a user