[Galene] Re: "This operation is insecure"

[Juliusz Chroboczek <jch@irif.fr>]

> FWIW the Apache httpd config settings:

>   Header onsuccess unset Content-Security-Policy
>   Header always set Content-Security-Policy "base-uri 'self'; child-src
> 'self'; connect-src 'self'; default-src 'self'; font-src 'self';
> form-action 'self'; frame-ancestors 'none'; frame-src 'none'; img-src
> 'self' data:; media-src 'self'; object-src 'self'; script-src 'self';
> style-src 'self';"

> Note that this worked just fine until recent update.

I find that suprising.  The "wss:" entry in connect-src was added back in
the spring of 2020 because without it Galène wouldn't work on iPads.  As
to "media-src blob:", streaming videos from disk won't work without it.

Perhaps you could explain why you are munging the headers in the frontend.
Is there an actual attack that you're concerned about?  If so, then we
should think together about avoiding the attack, rather than having each
user use their own idiosyncratic set of security-related headers.

-- Juliusz