fix(CSP): move trusted list to default-src

2025-12-13 20:57:24 +01:00 · 2025-12-12 16:52:14 -06:00
parent 83b2ba7688
commit f51f0a0c93
1 changed files with 4 additions and 6 deletions
--- a/website/server/middlewares/index.js
+++ b/website/server/middlewares/index.js
@@ -69,19 +69,17 @@ export default function attachMiddlewares (app, server) {
    contentSecurityPolicy: {
      directives: {
        defaultSrc: [
-          '*.habitica.com',
          '*.amazonaws.com',
-        ],
-        imgSrc: null,
-        scriptSrc: [
-          '\'unsafe-eval\'',
          '*.habitica.com',
-          '*.amazonaws.com',
          'cloudfront.loggly.com',
          'js.stripe.com',
          'm.stripe.network',
          'static-na.payments-amazon.com',
        ],
+        imgSrc: '*',
+        scriptSrc: [
+          '\'unsafe-eval\'',
+        ],
        upgradeInsecureRequests: IS_PROD ? [] : null,
      },
    },