Skip to content

Conversation

@Fijxu
Copy link
Member

@Fijxu Fijxu commented Sep 28, 2025

Closes #5496

CSP with this in config.yml:

invidious_companion:
  - private_url: "http://localhost:8282/companion"
    public_url: "http://localhost:8282/companion"
  - private_url: "http://localhost:8282/companion"
    public_url: "http://localhost:8282/companion"
  - private_url: "http://localhost:8282/companion"
    public_url: "http://localhost:8282/companion"

Looks like this:

Content-Security-Policy: default-src 'none'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; font-src 'self' data:; connect-src 'self' http://localhost:8282 http://localhost:8282 http://localhost:8282; manifest-src 'self'; media-src 'self' blob: http://localhost:8282 http://localhost:8282 http://localhost:8282; child-src 'self' blob:; frame-src 'self'; frame-ancestors 'none'

@Fijxu Fijxu requested a review from unixfox September 28, 2025 03:45
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Prevent modification of CSP header when Invidious companion is present

1 participant