fix: bound browser input and resource policies

This commit is contained in:
Andy Dixon
2026-06-09 08:48:40 +01:00
parent cb84dba9cb
commit 1a0d361fcb
3 changed files with 55 additions and 2 deletions
+3 -2
View File
@@ -1,10 +1,11 @@
<!doctype html>
<html lang="en-GB">
<head>
<link rel="preload" href="./fonts/font.otf" as="font" type="font/otf" crossorigin>
<meta charset="utf-8" />
<meta name="viewport" content="width=device-width,initial-scale=1" />
<meta name="referrer" content="no-referrer" />
<meta http-equiv="Content-Security-Policy" content="default-src 'self'; base-uri 'none'; connect-src 'self'; font-src 'self'; form-action 'none'; frame-src 'none'; img-src 'self' data:; media-src 'none'; object-src 'none'; script-src 'self'; style-src 'self'; worker-src 'none'" />
<link rel="preload" href="./fonts/font.otf" as="font" type="font/otf" crossorigin />
<title>Mode 7. A horror story.</title>
<link rel="stylesheet" href="./css/style.css" />
</head>