fix(web): logout-path parity, CSP header, epub display fallback + small review nits

2026-09-07 17:17:33 +08:00
parent 67c95e7bdc
commit cc66a648b0
6 changed files with 35 additions and 16 deletions
@@ -5,6 +5,9 @@ server {
  # /etc/resolv.conf 的首个 nameserver 重写本行,兼容 podman aardvark-dns。
  resolver 127.0.0.11 valid=10s;

+  # spec §7 风险接受所假设的 CSP:全部同源,blob:/data: 供 SW/reader 用
+  add_header Content-Security-Policy "default-src 'self'; img-src 'self' blob: data:; worker-src 'self' blob:; style-src 'self' 'unsafe-inline'; connect-src 'self' blob: data:; object-src 'none'; frame-src 'self' blob:" always;
+
  location /api/ {
    set $api_upstream http://api:8080;   # 变量式 → 每次按 DNS 解析,scale 后轮询到新副本(spec §11)
    proxy_pass $api_upstream;            # 无 URI 部分:保留 /api 前缀转发