This commit is contained in:
xadyz1 2026-07-26 14:31:15 +01:00
parent 7aa5497360
commit 09eb887cf7
2 changed files with 2 additions and 2 deletions

View file

@ -97,13 +97,13 @@ const dashboardCsp = helmet.contentSecurityPolicy({
// Both are required — with only the script entry the beacon loads but silently can't report. // Both are required — with only the script entry the beacon loads but silently can't report.
scriptSrc: ["'self'", 'https://static.cloudflareinsights.com'], scriptSrc: ["'self'", 'https://static.cloudflareinsights.com'],
scriptSrcAttr: ["'unsafe-inline'"], scriptSrcAttr: ["'unsafe-inline'"],
styleSrc: ["'self'", "'unsafe-inline'"], styleSrc: ["'self'", "'unsafe-inline'", "https://fonts.googleapis.com"],
styleSrcAttr: ["'unsafe-inline'"], styleSrcAttr: ["'unsafe-inline'"],
imgSrc: ["'self'", 'data:', 'blob:', 'https:'], imgSrc: ["'self'", 'data:', 'blob:', 'https:'],
mediaSrc: ["'self'", 'blob:', 'https:'], mediaSrc: ["'self'", 'blob:', 'https:'],
// 'wss:'/'ws:' keep the dashboard's socket.io connection working; the CF entry lets the beacon report. // 'wss:'/'ws:' keep the dashboard's socket.io connection working; the CF entry lets the beacon report.
connectSrc: ["'self'", 'wss:', 'ws:', 'https:', 'https://cloudflareinsights.com'], connectSrc: ["'self'", 'wss:', 'ws:', 'https:', 'https://cloudflareinsights.com'],
fontSrc: ["'self'", 'data:'], fontSrc: ["'self'", 'data:', 'https://fonts.gstatic.com'],
frameSrc: ["'self'", 'https://www.youtube.com', 'https://youtube.com'], frameSrc: ["'self'", 'https://www.youtube.com', 'https://youtube.com'],
objectSrc: ["'none'"], objectSrc: ["'none'"],
baseUri: ["'self'"], baseUri: ["'self'"],