Add a default CSP

Disallows loading external ressources. Providers can override it with
their reverse proxy settings.

1 files changed, 7 insertions, 0 deletions

diff --git a/server.go b/server.go
index ab42684..df48303 100644
--- a/server.go
+++ b/server.go
@@ -168,6 +168,13 @@ func New(e *echo.Echo, options *Options) error {
 
 	e.Use(func(next echo.HandlerFunc) echo.HandlerFunc {
 		return func(ectx echo.Context) error {
+			ectx.Response().Header().Set("Content-Security-Policy", "default-src 'self'")
+			return next(ectx)
+		}
+	})
+
+	e.Use(func(next echo.HandlerFunc) echo.HandlerFunc {
+		return func(ectx echo.Context) error {
 			ctx := &Context{Context: ectx, Server: s}
 			ctx.Set("context", ctx)