krikkert/habitica
1
0
Fork 0
mirror of https://github.com/HabitRPG/habitica.git synced 2025-12-17 06:37:23 +01:00
Code Issues Packages Projects Releases Wiki Activity

feat(security): implement CSP

Browse Source
This commit is contained in:
Kalista Payne
2025-11-25 09:27:05 -06:00
parent 72539f9ba3
commit 9462e90f4f
1 changed files with 13 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
website/server/middlewares/index.js
View File

@@ -66,7 +66,19 @@ export default function attachMiddlewares (app, server) {
// See https://helmetjs.github.io/ for the list of headers enabled by default // See https://helmetjs.github.io/ for the list of headers enabled by default
app.use(helmet({ app.use(helmet({
// New middlewares added by default in Helmet 4 are disabled // New middlewares added by default in Helmet 4 are disabled
contentSecurityPolicy: false, // @TODO implement contentSecurityPolicy: {
directives: {
imgSrc: null,
scriptSrc: [
'\'self\'',
'cloudfront.loggly.com',
'js.stripe.com',
'm.stripe.network',
'static-na.payments-amazon.com',
],
upgradeInsecureRequests: IS_PROD ? [] : null,
},
},
expectCt: false, expectCt: false,
permittedCrossDomainPolicies: false, permittedCrossDomainPolicies: false,
referrerPolicy: false, referrerPolicy: false,