Recommended CSP

[gene-git]

First - thank you for actively working on this project, It really is very much appreciated.

Wondering what your thoughts are around the most secure content security policy that can be used for Snappymail.
And do you have any plans / ideas to allow removal of stuff like 'unsafe-inline' (which seems to be needed for both style-src and script-src)?

thanks again

[the-djmaze]

unsafe-inline on the style-src is needed for email because html emails are self contained.
unsafe-inline & unsafe-eval on script-src might be dropped in the future when everything works with it (which it doesn't at the moment.

Tighten it even more is hardly impossible due to the nature of email (remote images for example).
But for the images there is the proxy feature, see #16

[gene-git]

Thank you - and the earlier discussion was informative - you're definitely helping me slowly get up to speed.