diff options
| author | Erik Michelson | 2020-09-08 09:58:15 +0200 |
|---|---|---|
| committer | Erik Michelson | 2020-09-08 09:58:15 +0200 |
| commit | 4ece86f0efa1f8f3e4dab0abf810800a045ce632 (patch) | |
| tree | b3d0997adf54e1d4105f9bf6949f509b5abd6699 /docs | |
| parent | 387e6682757d32b9d9e9b7e3d443143a39ce2184 (diff) | |
Update documentation and messages to new default value
Signed-off-by: Erik Michelson <github@erik.michelson.eu>
Diffstat (limited to 'docs')
| -rw-r--r-- | docs/configuration.md | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/docs/configuration.md b/docs/configuration.md index 2b3ccad1..af4f26ce 100644 --- a/docs/configuration.md +++ b/docs/configuration.md @@ -81,7 +81,7 @@ these are rarely used for various reasons. | `csp` | | `{"enable": true, "directives": {"scriptSrc": "trustworthy-scripts.example.com"}, "upgradeInsecureRequests": "auto", "addDefaults": true}` | Configures [Content Security Policy](https://helmetjs.github.io/docs/csp/). Directives are passed to Helmet - see [their documentation](https://helmetjs.github.io/docs/csp/) for more information on the format. Some defaults are added to the configured values so that the application doesn't break. To disable this behaviour, set `addDefaults` to `false`. Further, if `usecdn` is on, some CDN locations are allowed too. By default (`auto`), insecure (HTTP) requests are upgraded to HTTPS via CSP if `useSSL` is on. To change this behaviour, set `upgradeInsecureRequests` to either `true` or `false`. | | | `CMD_CSP_ENABLE` | **`true`** or `false` | whether to enable Content Security Policy (directives cannot be configured with environment variables) | | | `CMD_CSP_REPORTURI` | **`undefined`**, `https://<someid>.report-uri.com/r/d/csp/enforce` | Allows to add a URL for CSP reports in case of violations | -| `cookiePolicy` | `CMD_COOKIE_POLICY` | **`strict`**, `lax` or `none` | Set a SameSite policy whether cookies are send from cross-origin. Be careful: setting a SameSite value of none without https breaks the editor | +| `cookiePolicy` | `CMD_COOKIE_POLICY` | **`lax`**, `strict` or `none` | Set a SameSite policy whether cookies are send from cross-origin. Be careful: setting a SameSite value of none without https breaks the editor | ## Privacy and External Requests |