Skip to content

ContentSecurityPolicy.md

Jump to bottom
Chris edited this page Jun 22, 2025 · 3 revisions

Content Security Policy (CSP)

DockFlare's Web UI includes a Content Security Policy (CSP) to enhance its security and ensure compatibility with modern deployment practices.

What is CSP?

Content Security Policy is a standard security feature that tells a web browser which sources of content (like scripts, styles, and images) are trusted and can be loaded. It acts as a defense against common web attacks like Cross-Site Scripting (XSS) by preventing the browser from loading malicious assets.

Why does DockFlare use it?

  1. To Secure the Web UI: The primary reason is to protect the user interface itself. The CSP locks down the UI so that it can only load its own trusted JavaScript and CSS files, mitigating the risk of injected, malicious code.
  2. To Ensure Reverse Proxy Compatibility: Many modern reverse proxies (like Nginx, Traefik, or Caddy) operate more securely when the applications behind them serve proper security headers. By including a well-configured CSP, DockFlare ensures its UI works smoothly and reliably out-of-the-box in these common setups.
  3. To Follow Best Practices: Implementing a CSP is a recommended security practice for any web application.

What This Means For You

  • For most users, this feature is completely transparent. You do not need to do anything, and it simply makes the application more secure.
  • If you use a reverse proxy, the built-in CSP is designed to work correctly. However, if your proxy is configured to add its own, more restrictive CSP headers, you may need to adjust your proxy's configuration to ensure it doesn't block the UI's essential resources, which are all loaded from the same origin as the UI itself.
Clone this wiki locally