Restrict CSP even more (tighten report-only object-src)

mozilla · Nov 10, 2024 · ab3e5b2 · ab3e5b2
1 parent cd28718
commit ab3e5b2
Showing 1 changed file with 1 addition and 0 deletions.
diff --git a/bedrock/settings/__init__.py b/bedrock/settings/__init__.py
@@ -123,6 +123,7 @@
 
     # CSP directive updates we're testing that we hope to move to the enforced policy.
     CONTENT_SECURITY_POLICY_REPORT_ONLY["DIRECTIVES"]["default-src"] = [csp.constants.SELF]
+    CONTENT_SECURITY_POLICY_REPORT_ONLY["DIRECTIVES"]["object-src"] = [csp.constants.NONE]
     CONTENT_SECURITY_POLICY_REPORT_ONLY["DIRECTIVES"]["frame-ancestors"] = [csp.constants.NONE]
     CONTENT_SECURITY_POLICY_REPORT_ONLY["DIRECTIVES"]["style-src"].remove(csp.constants.UNSAFE_INLINE)