From 8fc58cb580994efe8f5167739568afadfe9850d7 Mon Sep 17 00:00:00 2001 From: Chocobozzz Date: Mon, 17 Dec 2018 09:42:28 +0100 Subject: [PATCH] Fix CSP on dev mode --- server/middlewares/csp.ts | 11 +++++------ 1 file changed, 5 insertions(+), 6 deletions(-) diff --git a/server/middlewares/csp.ts b/server/middlewares/csp.ts index a0ed3710b..8b919af0d 100644 --- a/server/middlewares/csp.ts +++ b/server/middlewares/csp.ts @@ -8,19 +8,18 @@ const baseDirectives = Object.assign({}, mediaSrc: ["'self'", 'https:', 'blob:'], fontSrc: ["'self'", 'data:'], imgSrc: ["'self'", 'data:'], - scriptSrc: ["'self' 'unsafe-inline'"], + scriptSrc: ["'self' 'unsafe-inline' 'unsafe-eval'"], styleSrc: ["'self' 'unsafe-inline'"], - // objectSrc: ["'none'"], // only define to allow plugins, else let defaultSrc 'none' block it + objectSrc: ["'none'"], // only define to allow plugins, else let defaultSrc 'none' block it formAction: ["'self'"], frameAncestors: ["'none'"], baseUri: ["'self'"], - pluginTypes: ["'none'"], manifestSrc: ["'self'"], frameSrc: ["'self'"], // instead of deprecated child-src / self because of test-embed - workerSrc: ["'self'"], // instead of deprecated child-src - upgradeInsecureRequests: true + workerSrc: ["'self'"] // instead of deprecated child-src }, - (CONFIG.SERVICES['CSP-LOGGER'] != null) ? { reportUri: CONFIG.SERVICES['CSP-LOGGER'] } : {} + CONFIG.SERVICES['CSP-LOGGER'] ? { reportUri: CONFIG.SERVICES['CSP-LOGGER'] } : {}, + CONFIG.WEBSERVER.SCHEME === 'https' ? { upgradeInsecureRequests: true } : {} ) const baseCSP = helmet.contentSecurityPolicy({