diff --git a/src/app/middleware.js b/src/app/middleware.js index 2a40a4d..ddf8057 100644 --- a/src/app/middleware.js +++ b/src/app/middleware.js @@ -39,7 +39,7 @@ exports.setHTTPResponseHeaders = async function(ctx, next) { ctx.set('Public-Key-Pins', `pin-sha256="${config.server.httpsKeyPin}"; pin-sha256="${config.server.httpsKeyPinBackup}"; max-age=16070400`); } // CSP - ctx.set('Content-Security-Policy', "default-src 'self'; object-src 'none'; script-src 'self' code.jquery.com; style-src 'self' maxcdn.bootstrapcdn.com; font-src 'self' maxcdn.bootstrapcdn.com"); + ctx.set('Content-Security-Policy', "default-src 'self'; object-src 'none'; script-src 'self' code.jquery.com; style-src 'self' stackpath.bootstrapcdn.com; font-src 'self' stackpath.bootstrapcdn.com"); // Prevent rendering website in foreign iframe (Clickjacking) ctx.set('X-Frame-Options', 'DENY'); // CORS diff --git a/src/static/index.html b/src/static/index.html index 229a95f..5a4b17c 100644 --- a/src/static/index.html +++ b/src/static/index.html @@ -8,7 +8,7 @@
No more key signing parties or publishing your social network online. You can even delete your public key at anytime. Learn more
-The server offers a modern REST api over HTTPS with HSTS and public key pinning that can be integrated into any app architecture. Learn more
+The server offers a modern REST API over HTTPS with HSTS and public key pinning that can be integrated into any app architecture. Learn more
© 2016 Mailvelope GmbH
+© 2019 Mailvelope GmbH