365DevNet/365devnet
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Update Content-Security-Policy in server.js to enhance security

Browse Source 
- Modified the Content-Security-Policy to allow 'unsafe-inline' for script-src, improving compatibility with existing scripts while maintaining security measures.
This commit is contained in:
Richard Bergsma
2025-11-06 12:40:45 +01:00
parent 0299359a0f
commit 993d16d920
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
server.js
View File

@@ -25,7 +25,7 @@ app.use((req, res, next) => {
if (process.env.ENABLE_SSR_CSP === '1') { if (process.env.ENABLE_SSR_CSP === '1') {
res.setHeader( res.setHeader(
'Content-Security-Policy', 'Content-Security-Policy',
"default-src 'self' https://365devnet.eu https://*.365devnet.eu; script-src 'self' 'wasm-unsafe-eval' 'nonce-astro' https://chat.365devnet.eu; style-src 'self' 'unsafe-inline'; img-src 'self' data: https://cdn.pixabay.com https://raw.githubusercontent.com; font-src 'self' data:; connect-src 'self' https://365devnet.eu https://chat.365devnet.eu wss://chat.365devnet.eu; frame-src https://chat.365devnet.eu; frame-ancestors 'none'; base-uri 'self'; form-action 'self'" "default-src 'self' https://365devnet.eu https://*.365devnet.eu; script-src 'self' 'unsafe-inline' 'wasm-unsafe-eval' 'nonce-astro' https://chat.365devnet.eu; style-src 'self' 'unsafe-inline'; img-src 'self' data: https://cdn.pixabay.com https://raw.githubusercontent.com; font-src 'self' data:; connect-src 'self' https://365devnet.eu https://chat.365devnet.eu wss://chat.365devnet.eu; frame-src https://chat.365devnet.eu; frame-ancestors 'none'; base-uri 'self'; form-action 'self'"
); );
} }
next(); next();