Mercurial > prosody-modules

diff mod_http_oauth2/README.markdown @ 5547:d4a2997deae9

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
mod_http_oauth2: Make CSP configurable E.g. to enable forbidding all scripts if you don't use any scripts, or allow scripts from your separate static content domain, etc.
author Kim Alvefur <zash@zash.se>
date Sun, 11 Jun 2023 14:06:28 +0200
parents ae20da6d377d
children d6ab6f0bd96e
line wrap: on
line diff
--- a/mod_http_oauth2/README.markdown	Sun Jun 11 14:03:27 2023 +0200
+++ b/mod_http_oauth2/README.markdown	Sun Jun 11 14:06:28 2023 +0200
@@ -85,6 +85,13 @@
 }
 ```
 
+If you know what features your templates use use you can adjust the
+`Content-Security-Policy` header to only allow what is needed:
+
+```lua
+oauth2_security_policy = "default-src 'self'" -- this is the default
+```
+
 ### Token parameters
 
 The following options configure the lifetime of tokens issued by the module.