1 files changed, 10 insertions, 1 deletions
diff --git a/src/lib.rs b/src/lib.rs
index 6d8e784..e2fac56 100644
--- a/src/lib.rs
+++ b/src/lib.rs
@@ -311,7 +311,16 @@ St: Clone + Send + Sync + 'static
         .layer(tower_http::set_header::SetResponseHeaderLayer::appending(
             axum::http::header::CONTENT_SECURITY_POLICY,
             axum::http::HeaderValue::from_static(
-                "default-src 'self'; img-src https:; script-src 'self'; style-src 'self'; base-uri 'none'; object-src 'none'"
+                concat!(
+                    "default-src 'none';", // Do not allow unknown things we didn't foresee.
+                    "img-src https:;",     // Allow hotlinking images from anywhere.
+                    "form-action 'self';", // Only allow sending forms back to us.
+                    "media-src 'self';",   // Only allow embedding media from us.
+                    "script-src 'self';",  // Only run scripts we serve.
+                    "style-src 'self';",   // Only use styles we serve.
+                    "base-uri 'none';",    // Do not allow to change the base URI.
+                    "object-src 'none';",  // Do not allow to embed objects (Flash/ActiveX).
+                )
             )
         ))
 }