Getting ready for the next CSS Naked Day
This year, I missed the CSS Naked Day.
I very much like the idea of ensuring my blog is also readable without CSS.
Thus to make sure I'll not miss it next year, I've added the following snippet into my nginx config:
set $csp_style "'unsafe-inline' blog.x-way.org https://*.disquscdn.com https://gist.x-way.org/assets/"; if ( $time_iso8601 ~* ^20[0-9][0-9]-0?4-0?9T.*$ ) { set $csp_style "'none'"; } include /etc/nginx/conf_includes/x-way.org_security_headers;
It's using a very basic mechanism to ensure no CSS is shown on April 9 next year (or any other year)
First it checks if the date is April 9, and if yes it sets the variable for the style-src
Content-Security-Policy header to 'none'
.
Which forbids the browser to load any CSS when rendering my blog.
Now let's see how it looks next April 9th ☺️