ekzyis
/
stacker.news
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Use default-src 'self' a.stacker.news (#1349) 

This should fix CSP errors in Firefox because scripts fetched via <link rel="prefetch"> don't use script-src.
This commit is contained in:
ekzyis 2024-09-02 19:58:14 +02:00 committed by GitHub
parent 07ebc60bc3
commit a7066a34cd
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
middleware.js
View File

@ -83,7 +83,7 @@ export function middleware (request) {
const cspHeader = [
// if something is not explicitly allowed, we don't allow it.
"default-src 'none'",
"default-src 'self' a.stacker.news",
"font-src 'self' a.stacker.news",
// we want to load images from everywhere but we can limit to HTTPS at least
"img-src 'self' a.stacker.news m.stacker.news https: data: blob:" + devSrc,