Versões comparadas

Chave

  • Esta linha foi adicionada.
  • Esta linha foi removida.
  • A formatação mudou.

...

Bloco de código
<?xml version="1.0" encoding="UTF-8"?>
<configuration>
    <appSettings>
        <add key="StackTraceVisible" value="false" />
    </appSettings>
    <system.web>
        <compilation debug="false" />
    </system.web>
    <system.webServer>
        <httpProtocol>
            <customHeaders>
                <add name="Content-Security-Policy" value="default-src 'self'; 
                    value="default                                       script-src 'self'; 
						script-srcreport-sample' 'self'; 
						                                                           style-src 'self' 'unsafe-inline'; 
						                                                           object-src 'none'; 
						                                                           base-uri 'self'; 
						                                                           connect-src 'self' http://{HOST_API_URL}localhost:8051 ws://{HOST_API_URL}; 
						localhost:8051; 
                                                           font-src 'self'; 
						                                                           frame-src 'self'; 
						                                                           img-src 'self' data: https://api.tiles.mapbox.com https://c.tile.openstreetmap.org https://a.tile.openstreetmap.org https://b.tile.openstreetmap.org https://api.qrserver.com https://chart.googleapis.com; 
						;
                                                           manifest-src 'self'; 
						                                                           media-src 'self'; 
						report-uri https://676eff58cfdd640ab319c568.endpoint.csper.io?builder=true&v=5; 
						                                                           worker-src 'none';" />
                <add name="X-Content-Type-Options" value="nosniff" />
                <add name="X-Xss-Protection" value="1; mode=block" />
                <add name="X-Frame-Options" value="SAMEORIGIN" />
                <add name="Cache-Control" value="no-store" />
                <add name="Strict-Transport-Security" value="max-age=31536000; includeSubDomains; preload" />
                <add name="Cross-Origin-Embedder-Policy" value="require-corp" />
                <add name="Cross-Origin-Resource-Policy" value="same-origin" />
                <add name="Cross-Origin-Opener-Policy" value="same-origin" />
                <add name="Permissions-Policy" value="camera=(self), microphone=(self), geolocation=(self), fullscreen=(self)" />
                <add name="Referrer-Policy" value="no-referrer-when-downgrade" />
                <remove name="X-Powered-By" />
            </customHeaders>
        </httpProtocol>
        <security>
            <requestFiltering removeServerHeader="true">
                <verbs>
                    <add verb="TRACE" allowed="false" />
                </verbs>
            </requestFiltering>
        </security>
    </system.webServer>
    <system.web>
        <httpRuntime enableVersionHeader="false" />
        <pages viewStateEncryptionMode="Always" />
    </system.web>
</configuration>

...