[GH-ISSUE #218] [FEATURE] Send Content Security Policy (CSP) Header #151

New issue

Closed

opened 2026-02-25 20:35:02 +03:00 by kerem · 1 comment

kerem commented

2026-02-25 20:35:02 +03:00

Owner

Originally created by @pred2k on GitHub (Mar 7, 2021).
Original GitHub issue: https://github.com/benbusby/whoogle-search/issues/218

Describe the feature you'd like to see added
To prevent any accidental connection (ip leaks) to google or others, whoogle should send a strong CSP Header.

I use the following in my reverse proxy without breaking functionality in FireFox 86.
Inline scripts ("script-src") and images
data:image/png;base64,iVBORw0KGgoAAAANSU… ("img-src")
are blocked, says the console

default-src 'none';
img-src 'self';
style-src 'self' 'unsafe-inline';
script-src 'self';
media-src 'self';
connect-src 'self';
form-action 'self';
upgrade-insecure-requests;

This would offer CSP to all kinds of deployments.

Additional context
https://en.wikipedia.org/wiki/Content_Security_Policy
https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP
https://cheatsheetseries.owasp.org/cheatsheets/Content_Security_Policy_Cheat_Sheet.html

Originally created by @pred2k on GitHub (Mar 7, 2021). Original GitHub issue: https://github.com/benbusby/whoogle-search/issues/218 **Describe the feature you'd like to see added** To prevent any accidental connection (ip leaks) to google or others, whoogle should send a strong CSP Header. I use the following in my reverse proxy without breaking functionality in FireFox 86. Inline scripts ("script-src") and images data:image/png;base64,iVBORw0KGgoAAAANSU… ("img-src") are blocked, says the console ``` default-src 'none'; img-src 'self'; style-src 'self' 'unsafe-inline'; script-src 'self'; media-src 'self'; connect-src 'self'; form-action 'self'; upgrade-insecure-requests; ``` This would offer CSP to all kinds of deployments. **Additional context** https://en.wikipedia.org/wiki/Content_Security_Policy https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP https://cheatsheetseries.owasp.org/cheatsheets/Content_Security_Policy_Cheat_Sheet.html

kerem

2026-02-25 20:35:02 +03:00

closed this issue
added the
enhancement
label

kerem commented

2026-02-25 20:35:02 +03:00

Author

Owner

@benbusby commented on GitHub (Mar 7, 2021):

Good thinking, thanks for the recommendation. Added in a1134e7633.

@benbusby commented on GitHub (Mar 7, 2021): Good thinking, thanks for the recommendation. Added in a1134e7633b05a3c686b89873ad249b131d46ccd.