Sorry, new guy here.
So about images, on my desktop browser, when I click just on the thumbnail to the side, I'm expecting the image to display. But the image loading graphics just keep looping without any image.
If I click the post, the image typically displays as expected.
On Voyager, tapping the thumbnail loads the image to the screen as expected.
#solved
EDIT: 2025-10-25 at 11h29 - I deleted the Content-Security-Policy and PieFed displays images as expected.
Reasoning
So after crawling through some very old Reddit posts, I came across other self-hosters discussing their new found interest in Security Headers from 5 years ago (dated, yes). Among the comments was a post by pentesticals (glorious):
quote
Don't stress about security headers and CSP. These are there to help provide additional protection against client-side issues which may or may not be present.
These will not have any direct impact on your services you expose, rather they aim to be a last resort to protect your browser in case an attacker tries to exploit existing vulnerabilities such as a Cross Site Scripting - but not having these does not increase the risk of your server being compromised.
Use Nessus Essentials for scanning your services and have fun.
https://www.reddit.com/r/selfhosted/comments/mpzl8f/any_recommendations_for_security_scans/
I use Caddy and I can indeed see the security headers that involve CSP. How should this setting be amended?
For what it's worth I looked over the "Using Caddy as reverse proxy" for Lemmy, and I notice that they just don't use the Content-Security-Policy option at all. I'm wondering if I should simply delete this Header for PieFed.
https://join-lemmy.org/docs/administration/caddy.html
Security Headers
(security_headers) {
header {
Strict-Transport-Security "max-age=31536000; includeSubDomains"
X-Content-Type-Options "nosniff"
X-Frame-Options "SAMEORIGIN"
Referrer-Policy "no-referrer"
X-XSS-Protection "1; mode=block"
Permissions-Policy "camera=(), microphone=(), geolocation=(), accelerometer=(), autoplay=(), fullscreen=(), gyroscope=(), interest-cohort=(), magnetometer=(), payment=()"
-Server
-x-powered-by
}
}