From fb12628115e7f442377fd37352b0d821ffe6995b Mon Sep 17 00:00:00 2001
From: Vesa Luusua <vesa.luusua@gmail.com>
Date: Fri, 16 Mar 2018 11:59:43 +0200
Subject: [PATCH] CSP improvements

---
 server/csp.js | 38 +++++++++++++++++++++++++-------------
 1 file changed, 25 insertions(+), 13 deletions(-)

diff --git a/server/csp.js b/server/csp.js
index 6d7d40f8..63292d0a 100644
--- a/server/csp.js
+++ b/server/csp.js
@@ -21,26 +21,38 @@ module.exports = (reportUri, enforceSsl, reportOnly) => {
   const inline = "'unsafe-inline'";
   const data = 'data:';
   const sharetribeApi = process.env.REACT_APP_SHARETRIBE_SDK_BASE_URL;
-  const sharetribeAssets = 'https://assets-sharetribecom.sharetribe.com/';
-  const imgix = '*.imgix.net/';
-  const loremPixel = 'https://lorempixel.com/';
-  const placeholder = 'https://via.placeholder.com/';
-  const googleAnalytics = 'https://www.google-analytics.com/';
-  const googleAnalyticsDoubleClick = 'https://stats.g.doubleclick.net/';
-  const googleMaps = 'https://maps.googleapis.com/';
-  const googleStaticFonts = 'https://fonts.gstatic.com/';
+  const sharetribeAssets = 'https://assets-sharetribecom.sharetribe.com';
+  const imgix = '*.imgix.net';
+  // Safari 9.1 didn't regocnize asterisk rule.
+  const sharetribeImgix = 'https://sharetribe.imgix.net';
+  const loremPixel = 'https://lorempixel.com';
+  const placeholder = 'https://via.placeholder.com';
+  const googleAnalytics = 'https://www.google-analytics.com';
+  const googleAnalyticsDoubleClick = 'https://stats.g.doubleclick.net';
+  const googleMaps = 'https://maps.googleapis.com';
+  const googleStaticFonts = 'https://fonts.gstatic.com';
   const googleStatic = '*.gstatic.com';
-  const googleFonts = 'https://fonts.googleapis.com/';
-  const stripeJs = 'https://js.stripe.com/';
-  const stripeQ = 'https://q.stripe.com/';
-  const stripeApi = 'https://api.stripe.com/';
+  const googleFonts = 'https://fonts.googleapis.com';
+  const stripeJs = 'https://js.stripe.com';
+  const stripeQ = 'https://q.stripe.com';
+  const stripeApi = 'https://api.stripe.com';
   const sentryApi = 'https://sentry.io/api/';
 
   const scriptSrc = [self, inline, data, googleMaps, stripeJs];
 
   const styleSrc = [self, inline, googleFonts];
 
-  const imgSrc = [self, data, imgix, loremPixel, placeholder, stripeQ, googleMaps, googleStatic];
+  const imgSrc = [
+    self,
+    data,
+    imgix,
+    sharetribeImgix,
+    loremPixel,
+    placeholder,
+    stripeQ,
+    googleMaps,
+    googleStatic,
+  ];
 
   const connectSrc = [self, sharetribeApi, googleMaps, stripeApi];