From 56423dd6de69ce2b7b4f67c3112e3e5b7533b6ae Mon Sep 17 00:00:00 2001 From: jamie Date: Sun, 27 Sep 2026 12:20:51 +0100 Subject: [PATCH] fix(nginx): allow inline styles for the browser image viewer --- deploy/nginx.conf.in | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/deploy/nginx.conf.in b/deploy/nginx.conf.in index eef33cd..bffd87a 100644 --- a/deploy/nginx.conf.in +++ b/deploy/nginx.conf.in @@ -23,7 +23,10 @@ server { add_header X-Robots-Tag "noindex, nofollow, noarchive, noimageindex" always; add_header X-Content-Type-Options "nosniff" always; add_header Referrer-Policy "no-referrer" always; - add_header Content-Security-Policy "default-src 'none'; sandbox" always; + # browsers style their built-in image viewer with inline CSS; without + # style-src 'unsafe-inline' an image opened directly renders unstyled. + # Raster images cannot carry styles, and scripts stay blocked. + add_header Content-Security-Policy "default-src 'none'; style-src 'unsafe-inline'; sandbox" always; add_header Cross-Origin-Resource-Policy "cross-origin" always; location = /robots.txt { @@ -46,7 +49,7 @@ server { add_header X-Robots-Tag "noindex, nofollow, noarchive, noimageindex" always; add_header X-Content-Type-Options "nosniff" always; add_header Referrer-Policy "no-referrer" always; - add_header Content-Security-Policy "default-src 'none'; sandbox" always; + add_header Content-Security-Policy "default-src 'none'; style-src 'unsafe-inline'; sandbox" always; add_header Cross-Origin-Resource-Policy "cross-origin" always; try_files $uri =404; }