[UPDATE-CONFIG] Use 3 hosts www, secure and static.

[gigi.git] / src / org / cacert / gigi / Gigi.java

diff --git a/src/org/cacert/gigi/Gigi.java b/src/org/cacert/gigi/Gigi.java
index 445fe365a2bda70e8408836251823e05653aa201..fa259c96c77cbf99835c8df72e374c863935bd3e 100644 (file)
--- a/src/org/cacert/gigi/Gigi.java
+++ b/src/org/cacert/gigi/Gigi.java
@@ -28,6 +28,7 @@ import org.cacert.gigi.pages.account.MailOverview;
 import org.cacert.gigi.pages.account.MyDetails;
 import org.cacert.gigi.pages.main.RegisterPage;
 import org.cacert.gigi.pages.wot.AssurePage;
+import org.cacert.gigi.util.ServerConstants;
 import org.eclipse.jetty.util.log.Log;
 
 public class Gigi extends HttpServlet {
@@ -149,8 +150,10 @@ public class Gigi extends HttpServlet {
                hsr.addHeader("Access-Control-Allow-Origin",
                                "http://cacert.org https://localhost");
                hsr.addHeader("Access-Control-Max-Age", "60");
-               // hsr.addHeader("Content-Security-Policy",
-               // "default-src 'self'; report-uri https://felix.dogcraft.de/report.php");
+               hsr.addHeader("Content-Security-Policy", "default-src 'self' https://"
+                               + ServerConstants.getStaticHostNamePort()
+                               + " https://www.cacert.org/*;frame-ancestors 'none'");
+               // ;report-uri https://felix.dogcraft.de/report.php
 
        }
 }