maverick/flex-template-web
1
0
Fork 0
mirror of https://github.com/kingomarnajjar/flex-template-web.git synced 2026-07-26 06:47:17 +10:00
Code Issues Projects Releases Packages Wiki Activity Actions

Add more CSP rules

Browse source
This commit is contained in:
Vesa Luusua 2018-03-15 14:15:26 +02:00
parent 366f3e9606
commit 44dca2dd80
1 changed files with 3 additions and 13 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

16
server/csp.js
View file

@ -29,9 +29,8 @@ module.exports = (reportUri, enforceSsl, reportOnly) => {
const googleAnalytics = 'https://www.google-analytics.com/';
const googleAnalyticsDoubleClick = 'https://stats.g.doubleclick.net/';
const googleMaps = 'https://maps.googleapis.com/';
const googleStaticCsi = 'https://csi.gstatic.com/';
const googleStaticFonts = 'https://fonts.gstatic.com/';
const googleStaticMaps = 'https://maps.gstatic.com/';
const googleStatic = '*.gstatic.com';
const googleFonts = 'https://fonts.googleapis.com/';
const stripeJs = 'https://js.stripe.com/';
const stripeQ = 'https://q.stripe.com/';
@ -42,17 +41,7 @@ module.exports = (reportUri, enforceSsl, reportOnly) => {
const styleSrc = [self, inline, googleFonts];
const imgSrc = [
self,
data,
imgix,
loremPixel,
placeholder,
stripeQ,
googleMaps,
googleStaticCsi,
googleStaticMaps,
];
const imgSrc = [self, data, imgix, loremPixel, placeholder, stripeQ, googleMaps, googleStatic];
const connectSrc = [self, sharetribeApi, googleMaps, stripeApi];
@ -67,6 +56,7 @@ module.exports = (reportUri, enforceSsl, reportOnly) => {
imgSrc.push(googleAnalytics);
imgSrc.push(googleAnalyticsDoubleClick);
connectSrc.push(googleAnalytics);
connectSrc.push(googleAnalyticsDoubleClick);
}
if (sentryClientEnabled) {
connectSrc.push(sentryApi);