MyBB Community Forums

MyBB Community Forums > 1.8 Support > Security Management and Support > Content-Security-Policy values
Full Version: Content-Security-Policy values
You're currently viewing a stripped down version of our content. View the full version with proper formatting.

Ekynox360

2020-12-10, 05:04 PM
In Setting up HTTPS, the Suggested value for MyBB Content-Security-Policy is :

upgrade-insecure-requests; default-src https: data: 'unsafe-inline' 'unsafe-eval'; frame-ancestors 'none'; base-uri 'self'

But online HTTP header scanners say "This policy contains 'unsafe-inline' which is dangerous in the default-src directive. This policy contains 'unsafe-eval' which is dangerous in the default-src directive." Is it possible to correct this without breaking myBB?

Devilshakerz

2020-12-10, 06:48 PM
Not right now, due to numerous inline scripts and styles: https://community.mybb.com/thread-224083...pid1333851
MyBB Community Forums > 1.8 Support > Security Management and Support > Content-Security-Policy values