maverick/flex-template-web
1
0
Fork 0
mirror of https://github.com/kingomarnajjar/flex-template-web.git synced 2026-07-26 06:47:17 +10:00
Code Issues Projects Releases Packages Wiki Activity Actions

CSP improvements

Browse source
This commit is contained in:
Vesa Luusua 2018-03-16 11:59:43 +02:00
parent ee5103dae7
commit fb12628115
1 changed files with 25 additions and 13 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

38
server/csp.js
View file

@ -21,26 +21,38 @@ module.exports = (reportUri, enforceSsl, reportOnly) => {
const inline = "'unsafe-inline'";
const data = 'data:';
const sharetribeApi = process.env.REACT_APP_SHARETRIBE_SDK_BASE_URL;
const sharetribeAssets = 'https://assets-sharetribecom.sharetribe.com/';
const imgix = '*.imgix.net/';
const loremPixel = 'https://lorempixel.com/';
const placeholder = 'https://via.placeholder.com/';
const googleAnalytics = 'https://www.google-analytics.com/';
const googleAnalyticsDoubleClick = 'https://stats.g.doubleclick.net/';
const googleMaps = 'https://maps.googleapis.com/';
const googleStaticFonts = 'https://fonts.gstatic.com/';
const sharetribeAssets = 'https://assets-sharetribecom.sharetribe.com';
const imgix = '*.imgix.net';
// Safari 9.1 didn't regocnize asterisk rule.
const sharetribeImgix = 'https://sharetribe.imgix.net';
const loremPixel = 'https://lorempixel.com';
const placeholder = 'https://via.placeholder.com';
const googleAnalytics = 'https://www.google-analytics.com';
const googleAnalyticsDoubleClick = 'https://stats.g.doubleclick.net';
const googleMaps = 'https://maps.googleapis.com';
const googleStaticFonts = 'https://fonts.gstatic.com';
const googleStatic = '*.gstatic.com';
const googleFonts = 'https://fonts.googleapis.com/';
const stripeJs = 'https://js.stripe.com/';
const stripeQ = 'https://q.stripe.com/';
const stripeApi = 'https://api.stripe.com/';
const googleFonts = 'https://fonts.googleapis.com';
const stripeJs = 'https://js.stripe.com';
const stripeQ = 'https://q.stripe.com';
const stripeApi = 'https://api.stripe.com';
const sentryApi = 'https://sentry.io/api/';
const scriptSrc = [self, inline, data, googleMaps, stripeJs];
const styleSrc = [self, inline, googleFonts];
const imgSrc = [self, data, imgix, loremPixel, placeholder, stripeQ, googleMaps, googleStatic];
const imgSrc = [
self,
data,
imgix,
sharetribeImgix,
loremPixel,
placeholder,
stripeQ,
googleMaps,
googleStatic,
];
const connectSrc = [self, sharetribeApi, googleMaps, stripeApi];