mirror of
https://github.com/screentinker/screentinker.git
synced 2026-08-17 07:34:15 -06:00
.
This commit is contained in:
parent
7aa5497360
commit
09eb887cf7
Binary file not shown.
|
|
@ -97,13 +97,13 @@ const dashboardCsp = helmet.contentSecurityPolicy({
|
||||||
// Both are required — with only the script entry the beacon loads but silently can't report.
|
// Both are required — with only the script entry the beacon loads but silently can't report.
|
||||||
scriptSrc: ["'self'", 'https://static.cloudflareinsights.com'],
|
scriptSrc: ["'self'", 'https://static.cloudflareinsights.com'],
|
||||||
scriptSrcAttr: ["'unsafe-inline'"],
|
scriptSrcAttr: ["'unsafe-inline'"],
|
||||||
styleSrc: ["'self'", "'unsafe-inline'"],
|
styleSrc: ["'self'", "'unsafe-inline'", "https://fonts.googleapis.com"],
|
||||||
styleSrcAttr: ["'unsafe-inline'"],
|
styleSrcAttr: ["'unsafe-inline'"],
|
||||||
imgSrc: ["'self'", 'data:', 'blob:', 'https:'],
|
imgSrc: ["'self'", 'data:', 'blob:', 'https:'],
|
||||||
mediaSrc: ["'self'", 'blob:', 'https:'],
|
mediaSrc: ["'self'", 'blob:', 'https:'],
|
||||||
// 'wss:'/'ws:' keep the dashboard's socket.io connection working; the CF entry lets the beacon report.
|
// 'wss:'/'ws:' keep the dashboard's socket.io connection working; the CF entry lets the beacon report.
|
||||||
connectSrc: ["'self'", 'wss:', 'ws:', 'https:', 'https://cloudflareinsights.com'],
|
connectSrc: ["'self'", 'wss:', 'ws:', 'https:', 'https://cloudflareinsights.com'],
|
||||||
fontSrc: ["'self'", 'data:'],
|
fontSrc: ["'self'", 'data:', 'https://fonts.gstatic.com'],
|
||||||
frameSrc: ["'self'", 'https://www.youtube.com', 'https://youtube.com'],
|
frameSrc: ["'self'", 'https://www.youtube.com', 'https://youtube.com'],
|
||||||
objectSrc: ["'none'"],
|
objectSrc: ["'none'"],
|
||||||
baseUri: ["'self'"],
|
baseUri: ["'self'"],
|
||||||
|
|
|
||||||
Loading…
Reference in a new issue