Aman-Mittal commented on issue #216: URL: https://github.com/apache/fineract-backoffice-ui/issues/216#issuecomment-5158697686
Done and merged in #217. `deploy/nginx.conf` now sets all five headers on the server block, each with `always` so they survive error responses — which is where a reflected payload would land. The CSP admits no `unsafe-eval` (the AOT build does not need it, and it would give an injected string a route to execution); `unsafe-inline` is scoped to styles only, because Angular emits component styles inline and there is no nonce plumbed through a static file server. `connect-src` allows the same origin only, so a deployment whose Fineract is on another host adds that origin here *as well as* to the application's allow-list — the two are deliberately separate, so a browser-side setting alone cannot open a new destination. Verified two ways rather than by grepping the file: `nginx -t` passes against the real `nginx:alpine` image, and all five headers were observed on an actual response served from it. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
