Claudio Ortolina
25 lines
680 B
Markdown
25 lines
680 B
Markdown
---
|
|
id: ML-75
|
|
title: Add Content-Security-Policy header to browser pipeline
|
|
status: Done
|
|
assignee: []
|
|
created_date: "2026-04-20 08:56"
|
|
labels: []
|
|
dependencies: []
|
|
references:
|
|
- "https://github.com/cloud8421/music_library/issues/100"
|
|
priority: low
|
|
---
|
|
|
|
## Description
|
|
|
|
<!-- SECTION:DESCRIPTION:BEGIN -->
|
|
|
|
_GitHub: created 2026-03-07 · updated 2026-03-07 · closed 2026-03-07_
|
|
|
|
Sobelow reports missing CSP on the browser pipeline (`router.ex:14`). Add a basic CSP via `put_secure_browser_headers/2`.
|
|
|
|
Currently the app does not set a `Content-Security-Policy` header, which is a defense-in-depth measure against XSS and other injection attacks.
|
|
|
|
<!-- SECTION:DESCRIPTION:END -->
|