fedi/lemmy-ui
1
0
Fork 0
mirror of https://github.com/LemmyNet/lemmy-ui.git synced 2024-11-09 10:02:12 +00:00
Code Issues Packages Projects Releases Wiki Activity

Change CSP rule for connect-src (websocket) to wildcard (fixes #730)

Browse source
This commit is contained in:
Felix Ableitner 2022-08-03 19:51:46 +02:00
parent 69b623b8fb
commit 59a448c040
1 changed files with 3 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
src/server/index.tsx
View file

@ -13,7 +13,7 @@ import process from "process";
import serialize from "serialize-javascript";
import { App } from "../shared/components/app/app";
import { SYMBOLS } from "../shared/components/common/symbols";
import { httpBaseInternal, wsUriBase } from "../shared/env";
import { httpBaseInternal } from "../shared/env";
import {
ILemmyConfig,
InitialFetchRequest,
@ -29,11 +29,11 @@ const [hostname, port] = process.env["LEMMY_UI_HOST"]
const extraThemesFolder =
process.env["LEMMY_UI_EXTRA_THEMES_FOLDER"] || "./extra_themes";
if (!process.env["LEMMY_UI_DEBUG"]) {
if (!process.env["LEMMY_UI_DISABLE_CSP"]) {
server.use(function (_req, res, next) {
res.setHeader(
"Content-Security-Policy",
`default-src 'none'; connect-src 'self' ${wsUriBase}; img-src * data:; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline'; form-action 'self'; base-uri 'self'`
`default-src 'none'; connect-src *; img-src * data:; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline'; form-action 'self'; base-uri 'self'`
);
next();
});