Commit 6546cd23 authored by yPhil's avatar yPhil
Browse files

CSP again

- Emergency commit on the server
parent 649550d9
Pipeline #495716 passed with stage
in 34 seconds
{
"name": "petrolette",
"description": "The news page that doesn't know you",
"version": "v1.5.6",
"version": "1.5.6",
"private": true,
"license": "GPL-3.0-only",
"HTTP_PORT": 8000,
......
......@@ -25,7 +25,18 @@ app.use(compression());
// app.use(helmet({contentSecurityPolicy: false, crossOriginEmbedderPolicy: false}));
app.use(helmet({contentSecurityPolicy: false, crossOriginEmbedderPolicy: false}));
app.use(
helmet.contentSecurityPolicy({
useDefaults: false,
directives: {
defaultSrc: ["'self'", "https://www.googleapis.com", "https://api.dropboxapi.com", "https://content.dropboxapi.com", "https:"],
imgSrc: ["'self'", "'unsafe-inline'", "https:", "data:"],
styleSrc: ["'self'", "'unsafe-inline'"],
scriptSrc: ["'self'", "'unsafe-inline'", "'unsafe-eval'"],
scriptSrcAttr: null
}
})
);
app.use(bodyParser.json());
app.use(bodyParser.urlencoded({ extended: false }));
......
This diff is collapsed.
......@@ -48,7 +48,7 @@
{
"url": "https://feeds.arstechnica.com/arstechnica/index",
"name": "Ars Technica",
"type": "text",
"type": "mixed",
"limit": 452,
"status": "on",
"iconhash": "909ebf2b292548840863bf882fe33f5b",
......
Supports Markdown
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment