Actions
Task #73047
closed
Content-Security-Policy for the Backend
Status:
Closed
Priority:
Should have
Assignee:
-
Category:
Security
Target version:
-
Start date:
2016-01-31
Due date:
% Done:
0%
Estimated time:
TYPO3 Version:
7
PHP Version:
Tags:
Complexity:
Sprint Focus:
Description
There is still (7.6) CSP Issues in the backend (/typo3) and I am wondering why ticket 63712 has been closed.
We should add a fitting CSP to the .htaccess in /typo3. Currently I am adding
Header set Content-Security-Policy "default-src * 'unsafe-eval' 'unsafe-inline';
in /typo3/.htaccess to overrule the more strict CSP of the website itself and make the backend work as well.
It would be a nice security feature if the TYPO3 backend would support a stricter CSP.
Updated by 
Updated by 
Updated by 
Updated by
Actions