[tahoe-lafs-trac-stream] [Tahoe-LAFS] #2136: Use Content-Security-Policy to harden the WUI

[Tahoe-LAFS]

#2136: Use Content-Security-Policy to harden the WUI
-----------------------------+---------------------------------------------
     Reporter:  freddyb      |      Owner:  daira
         Type:  defect       |     Status:  new
     Priority:  normal       |  Milestone:  undecided
    Component:  code-        |    Version:  1.10.0
  frontend-web               |   Keywords:  csp wui security xss javascript
   Resolution:               |
Launchpad Bug:               |
-----------------------------+---------------------------------------------

Comment (by daira):

 http://content-security-policy.com/ says which browser versions support
 which CSP headers. Basically, if we duplicate the `Content-Security-
 Policy` header to `X-Content-Security-Policy` and `X-Webkit-CSP`, we get
 support in earlier/more browsers.

--
Ticket URL: <https://tahoe-lafs.org/trac/tahoe-lafs/ticket/2136#comment:2>
Tahoe-LAFS <https://Tahoe-LAFS.org>
secure decentralized storage