From 5a00f7b825e3a44831e184aa5883301b1b1bb894 Mon Sep 17 00:00:00 2001 From: k00b Date: Wed, 4 Sep 2024 09:58:05 -0500 Subject: [PATCH] allow video in CSP --- middleware.js | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/middleware.js b/middleware.js index 7a965619..867802d3 100644 --- a/middleware.js +++ b/middleware.js @@ -87,7 +87,7 @@ export function middleware (request) { "font-src 'self' a.stacker.news", // we want to load images from everywhere but we can limit to HTTPS at least "img-src 'self' a.stacker.news m.stacker.news https: data: blob:" + devSrc, - "media-src 'self' a.stacker.news m.stacker.news" + devSrc, + "media-src 'self' a.stacker.news m.stacker.news https:" + devSrc, // Using nonces and strict-dynamic deploys a strict CSP. // see https://cheatsheetseries.owasp.org/cheatsheets/Content_Security_Policy_Cheat_Sheet.html#strict-policy. // Old browsers will ignore nonce and strict-dynamic and fallback to host-based matching and unsafe-inline