Update content security policy
This commit moves content security policy to use the modern header, not
a header begining with X.
Requires the content-security-policy patch series to function correctly.
Tested by:
Launched phosphor-webui, and observed webui launch, and no warnings in
debug tools.
Change-Id: I14a422d8a4047d0b05c937a31a5845f8eeb858c6
Signed-off-by: Ed Tanous <ed.tanous@intel.com>
diff --git a/include/security_headers_middleware.hpp b/include/security_headers_middleware.hpp
index 237438b..5e8e7d9 100644
--- a/include/security_headers_middleware.hpp
+++ b/include/security_headers_middleware.hpp
@@ -36,7 +36,7 @@
res.addHeader(bf::pragma, "no-cache");
res.addHeader(bf::cache_control, "no-Store,no-Cache");
- res.addHeader("X-Content-Security-Policy", "default-src 'self'");
+ res.addHeader("Content-Security-Policy", "default-src 'self'");
res.addHeader("X-XSS-Protection", "1; "
"mode=block");
res.addHeader("X-Content-Type-Options", "nosniff");