[GH-ISSUE #165] Wiki Update: Content Security Policy #109

New issue

Closed

opened 2026-03-15 12:36:24 +03:00 by kerem · 1 comment

kerem commented

2026-03-15 12:36:24 +03:00

Owner

Originally created by @junyang-chin on GitHub (Sep 15, 2023).
Original GitHub issue: https://github.com/axllent/mailpit/issues/165

Since v1.8.0 remote stylesheets is not blocked by default but this behaviour is not updated in the wiki

I have provided a draft paragraph that you could use and edit

The Mailpit UI does have a strict Content-Security-Policy header which prevents your browser from loading any remote content, except for images and stylesheets. This means that your web browser will block all iframes, inline & remote JavaScript within the UI.

To disable remote remote CSS stylesheets & fonts (eg: Google Fonts) use the --block-remote-css-and-fonts runtime option

Originally created by @junyang-chin on GitHub (Sep 15, 2023). Original GitHub issue: https://github.com/axllent/mailpit/issues/165 Since v1.8.0 remote stylesheets is not blocked by default but this behaviour is not updated in the [wiki](https://github.com/axllent/mailpit/wiki/UI-security-policies#content-security-policy) I have provided a draft paragraph that you could use and edit >The Mailpit UI does have a strict Content-Security-Policy header which prevents your browser from loading any remote content, except for images and stylesheets. This means that your web browser will block all iframes, inline & remote JavaScript within the UI. > >To disable remote remote CSS stylesheets & fonts (eg: Google Fonts) use the `--block-remote-css-and-fonts` runtime option

kerem closed this issue

2026-03-15 12:36:29 +03:00

kerem commented

2026-03-15 12:36:35 +03:00

Author

Owner

@axllent commented on GitHub (Sep 15, 2023):

Great catch, thanks @junyang-chin! I have updated the wiki with your suggestion :)

@axllent commented on GitHub (Sep 15, 2023): Great catch, thanks @junyang-chin! I have updated the wiki with your suggestion :)

kerem referenced this issue

2026-03-15 14:19:22 +03:00

[PR #109] [MERGED] Feature: Recipient allowlist for SMTP relay configuration #445