Introduce CSP headers to Kalamar (start of #72)
Change-Id: I84b7ff0accab3d783ad653fae123c25fee1d92b9
diff --git a/lib/Kalamar.pm b/lib/Kalamar.pm
index 61827f8..f5a111d 100644
--- a/lib/Kalamar.pm
+++ b/lib/Kalamar.pm
@@ -123,6 +123,22 @@
);
};
+ my $csp = $conf->{cs_policy} // (
+ "default-src 'self';".
+ "style-src 'self' 'unsafe-inline';".
+ "frame-src *;".
+ "media-src 'none';".
+ "object-src 'self';".
+ "font-src 'self';".
+ "img-src 'self' data:;"
+ );
+
+ $self->hook(
+ before_render => sub {
+ shift->res->headers->header('Content-Security-Policy' => $csp);
+ }
+ );
+
# API is not yet set - define
$conf->{api_path} //= $ENV{KALAMAR_API};
$conf->{api_version} //= $API_VERSION;