[Galene] Re: "This operation is insecure"

["Michael Ströder" <michael@stroeder.com>]

On 1/27/21 10:42 PM, Juliusz Chroboczek wrote:
>> FWIW the Apache httpd config settings:
> 
>>   Header onsuccess unset Content-Security-Policy
>>   Header always set Content-Security-Policy "base-uri 'self'; child-src
>> 'self'; connect-src 'self'; default-src 'self'; font-src 'self';
>> form-action 'self'; frame-ancestors 'none'; frame-src 'none'; img-src
>> 'self' data:; media-src 'self'; object-src 'self'; script-src 'self';
>> style-src 'self';"
> 
>> Note that this worked just fine until recent update.
> 
> I find that suprising.  The "wss:" entry in connect-src was added back in
> the spring of 2020 because without it Galène wouldn't work on iPads.  As
> to "media-src blob:", streaming videos from disk won't work without it.

Ok, following your advice I've successfully tested normal video
conference with an Safari-on-iPad user and the following complete CSP
header:

Content-Security-Policy: base-uri 'self'; child-src 'self'; connect-src
wss: 'self'; default-src 'self'; font-src 'self'; form-action 'self';
frame-ancestors 'none'; frame-src 'none'; img-src 'self' data:;
media-src blob: 'self'; object-src 'self'; script-src 'self'; style-src
'self';

Mainly I want to
1. disable frames.
2. limit connect-src to wss: because all traffic must be TLS encrypted.
3. tighten resource loading some more just in case some browsers might
not obey default-src 'self'.
4. set a report-uri later.

Ciao, Michael.