365DevNet/365devnet
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Update Content-Security-Policy in server.js and _headers for enhanced security

Browse Source 
- Modified the Content-Security-Policy to include specific domains for default-src and connect-src, improving security and flexibility.
- Updated the commented-out Content-Security-Policy in the _headers file to reflect the same changes for consistency.
This commit is contained in:
Richard Bergsma
2025-11-04 23:43:00 +01:00
parent f7645b7b25
commit efcb325f64
2 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
public/_headers
View File

@@ -9,4 +9,4 @@
Cross-Origin-Embedder-Policy: credentialless Cross-Origin-Embedder-Policy: credentialless
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
# Content-Security-Policy starter (enable after auditing inline scripts) # Content-Security-Policy starter (enable after auditing inline scripts)
# Content-Security-Policy: default-src 'self'; script-src 'self' 'wasm-unsafe-eval' 'nonce-astro' https://chat.365devnet.eu; style-src 'self' 'unsafe-inline'; img-src 'self' data: https://cdn.pixabay.com https://raw.githubusercontent.com; font-src 'self' data:; connect-src 'self' https://chat.365devnet.eu wss://chat.365devnet.eu; frame-src https://chat.365devnet.eu; frame-ancestors 'none'; base-uri 'self'; form-action 'self' # Content-Security-Policy: default-src 'self' https://365devnet.eu https://*.365devnet.eu; script-src 'self' 'wasm-unsafe-eval' 'nonce-astro' https://chat.365devnet.eu; style-src 'self' 'unsafe-inline'; img-src 'self' data: https://cdn.pixabay.com https://raw.githubusercontent.com; font-src 'self' data:; connect-src 'self' https://365devnet.eu https://chat.365devnet.eu wss://chat.365devnet.eu; frame-src https://chat.365devnet.eu; frame-ancestors 'none'; base-uri 'self'; form-action 'self'

2
server.js
View File

@@ -25,7 +25,7 @@ app.use((req, res, next) => {
if (process.env.ENABLE_SSR_CSP === '1') { if (process.env.ENABLE_SSR_CSP === '1') {
res.setHeader( res.setHeader(
'Content-Security-Policy', 'Content-Security-Policy',
"default-src 'self'; script-src 'self' 'wasm-unsafe-eval' 'nonce-astro' https://chat.365devnet.eu; style-src 'self' 'unsafe-inline'; img-src 'self' data: https://cdn.pixabay.com https://raw.githubusercontent.com; font-src 'self' data:; connect-src 'self' https://chat.365devnet.eu wss://chat.365devnet.eu; frame-src https://chat.365devnet.eu; frame-ancestors 'none'; base-uri 'self'; form-action 'self'" "default-src 'self' https://365devnet.eu https://*.365devnet.eu; script-src 'self' 'wasm-unsafe-eval' 'nonce-astro' https://chat.365devnet.eu; style-src 'self' 'unsafe-inline'; img-src 'self' data: https://cdn.pixabay.com https://raw.githubusercontent.com; font-src 'self' data:; connect-src 'self' https://365devnet.eu https://chat.365devnet.eu wss://chat.365devnet.eu; frame-src https://chat.365devnet.eu; frame-ancestors 'none'; base-uri 'self'; form-action 'self'"
); );
} }
next(); next();