strapi/examples/getstarted/config/environments/development/security.json

{
  "csp": {
    "enabled": true,
    "policy": ["block-all-mixed-content"]
  },
  "p3p": {
    "enabled": false,
    "value": ""
  },
  "hsts": {
    "enabled": true,
    "maxAge": 31536000,
    "includeSubDomains": true
  },
  "xframe": {
    "enabled": true,
    "value": "SAMEORIGIN"
  },
  "xss": {
    "enabled": true,
    "mode": "block"
  },
  "cors": {
    "enabled": true
  },
  "ip": {
    "enabled": false,
    "whiteList": [],
    "blackList": []
  }
}
Refactor strapi load 2019-04-05 16:11:09 +02:00			`{`
			`"csp": {`
Remove x-forwarded-host. - set security defaults for development mode that are standard - refactor error messages to work without ctx.request.admin - remove mask middleware and add a sanitization layer to the core-api to hide private fileds 2019-08-21 12:10:23 +02:00			`"enabled": true,`
Change csp config 2019-12-12 19:13:48 +01:00			`"policy": ["block-all-mixed-content"]`
Refactor strapi load 2019-04-05 16:11:09 +02:00			`},`
			`"p3p": {`
Disable p3p by default 2019-09-20 12:45:31 +02:00			`"enabled": false,`
Refactor strapi load 2019-04-05 16:11:09 +02:00			`"value": ""`
			`},`
			`"hsts": {`
Remove x-forwarded-host. - set security defaults for development mode that are standard - refactor error messages to work without ctx.request.admin - remove mask middleware and add a sanitization layer to the core-api to hide private fileds 2019-08-21 12:10:23 +02:00			`"enabled": true,`
Refactor strapi load 2019-04-05 16:11:09 +02:00			`"maxAge": 31536000,`
			`"includeSubDomains": true`
			`},`
			`"xframe": {`
Remove x-forwarded-host. - set security defaults for development mode that are standard - refactor error messages to work without ctx.request.admin - remove mask middleware and add a sanitization layer to the core-api to hide private fileds 2019-08-21 12:10:23 +02:00			`"enabled": true,`
Refactor strapi load 2019-04-05 16:11:09 +02:00			`"value": "SAMEORIGIN"`
			`},`
			`"xss": {`
Remove x-forwarded-host. - set security defaults for development mode that are standard - refactor error messages to work without ctx.request.admin - remove mask middleware and add a sanitization layer to the core-api to hide private fileds 2019-08-21 12:10:23 +02:00			`"enabled": true,`
Refactor strapi load 2019-04-05 16:11:09 +02:00			`"mode": "block"`
			`},`
			`"cors": {`
Use koa-router and fix graphql-uploads 2019-08-21 11:05:33 +02:00			`"enabled": true`
Refactor strapi load 2019-04-05 16:11:09 +02:00			`},`
			`"ip": {`
			`"enabled": false,`
			`"whiteList": [],`
			`"blackList": []`
			`}`
			`}`