[Galene] Re: "This operation is insecure"

["Michael Ströder" <michael@stroeder.com>]

On 1/27/21 10:09 PM, Michael Ströder wrote:
> On 1/27/21 9:30 PM, Juliusz Chroboczek wrote:
>>>>> It looks like some versions of Mobile Safari don't like our
>>>>> Content-Security-Policy header.
>>>>
>>>> Did the user try to enable a filter?
>>
>>> Probably not.
>>
>> Hmm... are you running behind a reverse proxy?  Is the reverse proxy
>> modifying our CSP header?
> 
> Yes.

FWIW the Apache httpd config settings:

  Header onsuccess unset Content-Security-Policy
  Header always set Content-Security-Policy "base-uri 'self'; child-src
'self'; connect-src 'self'; default-src 'self'; font-src 'self';
form-action 'self'; frame-ancestors 'none'; frame-src 'none'; img-src
'self' data:; media-src 'self'; object-src 'self'; script-src 'self';
style-src 'self';"

Note that this worked just fine until recent update.

Ciao, Michael.