Commits on Sep 24, 2021

1. [Security] Add 2 more Content-Security-Policy options …

   This adds to more CSP directives that are defined in CSP Level 3.
   (See: https://w3c.github.io/webappsec-csp/)
   
   `frame-ancestors: 'none'` prevents LORIS from being embedded in an
   iframe. This prevents the class of attacks where a third party embeds
   the page in an iframe, but covers it with an invisible div to intercept
   clicks or other interactions.
   
   `form-action: self` prevents forms from submitting data to a target that
   is off-site.

   

   driusan committed Sep 24, 2021
   Configuration menu

   • View commit details
   • Copy full SHA for 8db501d
   • Browse repository at this point

   Copy the full SHA

   8db501d View commit details

   Browse the repository at this point in the history