From 8600df101823e9fe71e4b13a4dfa4009726929b4 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?L=C3=A9o=20Colombaro?= <git@colombaro.fr>
Date: Mon, 28 Jun 2021 14:28:44 +0200
Subject: [PATCH] Make `Content-Security-Policy` disallow 'object-src' by
 default

Ref https://github.com/h5bp/server-configs-apache/issues/190
---
 nginx.conf | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/nginx.conf b/nginx.conf
index 56db890..cbb4a3e 100644
--- a/nginx.conf
+++ b/nginx.conf
@@ -105,7 +105,7 @@ http {
   # Add Content-Security-Policy for HTML documents.
   # h5bp/security/content-security-policy.conf
   map $sent_http_content_type $content_security_policy {
-    ~*text/(html|javascript)|application/pdf|xml "default-src 'self'; base-uri 'none'; form-action 'self'; frame-ancestors 'none'; upgrade-insecure-requests";
+    ~*text/(html|javascript)|application/pdf|xml "default-src 'self'; base-uri 'none'; form-action 'self'; frame-ancestors 'none'; object-src 'none'; upgrade-insecure-requests";
   }
 
   # Add Referrer-Policy for HTML documents.