From 3193b0f6e6c0d4056c253b5b64ba841a8b964ddc Mon Sep 17 00:00:00 2001
From: Blake Erickson <o.blakeerickson@gmail.com>
Date: Fri, 3 Jan 2020 13:35:30 -0700
Subject: [PATCH] FEATURE: Turn CSP on by default

Turning on CSP by default is one of the 2.4 release features.

https://meta.discourse.org/t/discourse-version-2-4/108194
---
 config/site_settings.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/config/site_settings.yml b/config/site_settings.yml
index d36ccedf892..038b2b6b0b7 100644
--- a/config/site_settings.yml
+++ b/config/site_settings.yml
@@ -1396,7 +1396,7 @@ security:
     list_type: compact
   slow_down_crawler_rate: 60
   content_security_policy:
-    default: false
+    default: true
   content_security_policy_report_only:
     default: false
   content_security_policy_collect_reports: