[tahoe-lafs-trac-stream] [Tahoe-LAFS] #2136: Use Content-Security-Policy to harden the WUI

[Tahoe-LAFS]

#2136: Use Content-Security-Policy to harden the WUI
-----------------------------+---------------------------------------------
     Reporter:  freddyb      |      Owner:  daira
         Type:  defect       |     Status:  new
     Priority:  normal       |  Milestone:  undecided
    Component:  code-        |    Version:  1.10.0
  frontend-web               |   Keywords:  csp wui security xss javascript
   Resolution:               |
Launchpad Bug:               |
-----------------------------+---------------------------------------------

Comment (by freddyb):

 The prefix has mostly been used by those browsers that update themselves,
 so I guess the impact is negligible. The notable exception here is
 probably iOS 6.1, since updates depend on the hardware here (cf.
 http://caniuse.com/#search=CSP)

--
Ticket URL: <https://tahoe-lafs.org/trac/tahoe-lafs/ticket/2136#comment:3>
Tahoe-LAFS <https://Tahoe-LAFS.org>
secure decentralized storage