Restrict CSP even more (tighten report-only object-src)

mozilla · Nov 21, 2024 · 6a99e0e · 6a99e0e
1 parent 0d43d4c
commit 6a99e0e
Showing 1 changed file with 1 addition and 0 deletions.
diff --git a/bedrock/settings/__init__.py b/bedrock/settings/__init__.py
@@ -123,6 +123,7 @@
 
     # CSP directive updates we're testing that we hope to move to the enforced policy.
     CONTENT_SECURITY_POLICY_REPORT_ONLY["DIRECTIVES"]["default-src"] = [csp.constants.SELF]
+    CONTENT_SECURITY_POLICY_REPORT_ONLY["DIRECTIVES"]["object-src"] = [csp.constants.NONE]
     CONTENT_SECURITY_POLICY_REPORT_ONLY["DIRECTIVES"]["frame-ancestors"] = [csp.constants.NONE]
     CONTENT_SECURITY_POLICY_REPORT_ONLY["DIRECTIVES"]["style-src"].remove(csp.constants.UNSAFE_INLINE)