Conversation

Notices

1. Embed this notice
   Oneesan succubus (lain@pleroma.soykaf.com)'s status on Friday, 26-May-2023 18:37:31 JST Oneesan succubus

   Just to be clear, if you run a pleroma server, it’s a very good idea to add this to your nginx config immediately:

   location ~ ^/(media|proxy) { add_header Content-Security-Policy "sandbox;";

   Most people will already not be vulnerable to this for a variety of reasons, but this will absolutely stop it.

   • Embed this notice
     Oneesan succubus (lain@pleroma.soykaf.com)'s status on Friday, 26-May-2023 19:22:53 JST Oneesan succubus

     in reply to

     • Luca Sironi
     @luca one of them is enough, a server had their admin oauth tokens stolen using a rather elaborate attack.
   • Embed this notice
     Luca Sironi (luca@sironi.tk)'s status on Friday, 26-May-2023 19:22:55 JST Luca Sironi

     in reply to

     @lain both header ?

     like this ?

     add_header Content-Security-Policy “sandbox;”;

     add_header Content-Security-Policy “script-src ‘none’;”;

     can you please elaborate what is this attack you’re speaking of ?