940febc3e8
Relax Content Security Policy (CSP) to ensure essential functionality of Vue, Ace and Vite legacy along with functioning developer experience with macOS Safari.
61 lines
2.2 KiB
HTML
61 lines
2.2 KiB
HTML
<!DOCTYPE html>
|
|
<html lang="en">
|
|
|
|
<head>
|
|
<meta charset="utf-8">
|
|
<meta name="viewport" content="width=device-width,initial-scale=1.0">
|
|
<title>Privacy is sexy 🍑🍆 - Enforce privacy & security on Windows, macOS and Linux</title>
|
|
<meta name="robots" content="index,follow" />
|
|
<meta name="description"
|
|
content="Web tool to generate scripts for enforcing privacy & security best-practices such as stopping data collection of Windows and different softwares on it." />
|
|
<link rel="icon" href="/favicon.ico">
|
|
|
|
<!--
|
|
Security meta tags based on OWASP recommendations.
|
|
See https://owasp.org/www-project-secure-headers/ci/headers_add.json for all recommended policies.
|
|
Exceptions:
|
|
- [+] `style-src 'unsafe-inline'` : Required for Vue.
|
|
- [+] `img-src data:` : Required for Ace (code editor) CSS.
|
|
- [+] `script-src: 'unsafe-inline'` : Required for Vite legacy (@vitejs/plugin-legacy) for production builds.
|
|
- [-] `upgrade-insecure-requests` : Required for development on macOS Safari or Safari will block requests on `http://localhost`.
|
|
-->
|
|
<meta
|
|
http-equiv="Content-Security-Policy"
|
|
content="
|
|
default-src 'self';
|
|
script-src 'self' 'unsafe-inline';
|
|
style-src 'self' 'unsafe-inline';
|
|
img-src 'self' data:;
|
|
form-action 'self';
|
|
object-src 'none';
|
|
block-all-mixed-content;
|
|
"
|
|
>
|
|
<meta name="referrer" content="no-referrer">
|
|
</head>
|
|
|
|
<body>
|
|
<noscript>
|
|
<style>
|
|
#javascriptDisabled {
|
|
background: #eceef1;
|
|
margin: 5rem auto;
|
|
max-width: 800px;
|
|
font-size: 7px;
|
|
padding: 3rem;
|
|
border: 1px solid#333a45;
|
|
font-size: 1.5rem;
|
|
line-height: 150%;
|
|
font-family: 'Monaco', 'Menlo', 'Ubuntu Mono', 'Consolas', 'source-code-pro', monospace;
|
|
}
|
|
</style>
|
|
<div id="javascriptDisabled">
|
|
<h1>Problem loading page</h1>
|
|
<p>The page does not work without JavaScript enabled. Please enable it to use privacy.sexy. There's no shady stuff
|
|
as 100% of the website is open source.</p>
|
|
</div>
|
|
</noscript>
|
|
<div id="app"></div>
|
|
<script type="module" src="/main.ts"></script>
|
|
</body>
|
|
</html> |