Disable in panel about kirby3-security-headers HOT 9 CLOSED

@S1SYPHOS i will add this to plugin as well as a check for the api url.

from kirby3-security-headers.

try bnomei.securityheaders.enabled option with a callback and return same check like here?

from kirby3-security-headers.

another idea would be to use the same isPanel check in

1. loader option and load a different json with unsave eval AND
2. return callback with null at the seed option to disable the nonce output then

CSP with nonce will not allow unsafe. thats just how it is.

from kirby3-security-headers.

Thanks for your ideas, they have already proven helpful!

I went with option No. 1:

'bnomei.securityheaders.loader' => function () {
    # Panel check, borrowed from @bnomei's `security-headers`
    # See https://github.com/steirico/kirby-plugin-custom-add-fields/issues/37
    $isPanel = strpos(
        kirby()->request()->url()->toString(),
        kirby()->urls()->panel
    ) !== false;

    if ($isPanel) {
        return kirby()->root('config') . '/settings/csp-backend.json';
    }

    return kirby()->root('config') . '/settings/csp-frontend.json';
}

.. hacky solution until v3.5 fixes this ;)

from kirby3-security-headers.

not 100% but i think you need to do [loader + seed] or [enabled].

from kirby3-security-headers.

Well, worked well as far as I could tell, but sure ..

'bnomei.securityheaders.enabled' => function () {
    # Panel check, borrowed from @bnomei's `security-headers`
    # See https://github.com/steirico/kirby-plugin-custom-add-fields/issues/37
    $isPanel = strpos(
        kirby()->request()->url()->toString(),
        kirby()->urls()->panel
    ) !== false;

    return !$isPanel;
},

from kirby3-security-headers.

https://github.com/bnomei/kirby3-security-headers/releases/tag/v2.4.0

from kirby3-security-headers.

@S1SYPHOS once updated to 2.4.0 you will have to remove your custom config value for bnomei.securityheaders.enabled or the api will still be using the headers

from kirby3-security-headers.

Roger that

from kirby3-security-headers.