awatertrevi/infisical
1
0
Fork 0
mirror of https://github.com/awatertrevi/infisical.git synced 2026-10-07 18:27:36 +00:00
Code Issues Packages Projects Releases Wiki Activity

Change CSP references from SITE_URL to self

Browse Source
This commit is contained in:
Tuan Dang
2022-11-29 23:41:31 -05:00
parent 0fde680a11
commit c3427d110a
1 changed files with 9 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files
frontend/next.config.js
+9 -13
View File
@@ -1,19 +1,15 @@
// next.config.js // next.config.js
const ContentSecurityPolicy = ` const ContentSecurityPolicy = `
default-src ${process.env.NEXT_PUBLIC_WEBSITE_URL};     default-src 'self';
script-src ${     script-src 'self' https://app.posthog.com https://js.stripe.com https://api.stripe.com 'unsafe-inline' 'unsafe-eval';
process.env.NEXT_PUBLIC_WEBSITE_URL     style-src 'self' https://rsms.me 'unsafe-inline';
} https://app.posthog.com https://infisical.com https://assets.calendly.com/ https://js.stripe.com https://api.stripe.com 'unsafe-inline' 'unsafe-eval';     child-src https://api.stripe.com;
style-src 'self' https://rsms.me 'unsafe-inline';     frame-src https://js.stripe.com/ https://api.stripe.com;
child-src https://infisical.com https://api.stripe.com;     connect-src 'self' https://api.heroku.com/ https://id.heroku.com/oauth/authorize https://id.heroku.com/oauth/token https://checkout.stripe.com https://app.posthog.com https://api.stripe.com;
frame-src https://js.stripe.com/ https://api.stripe.com;     img-src 'self' https://*.stripe.com https://i.ytimg.com/ data:;
connect-src ws://${process.env.NEXT_PUBLIC_WEBSITE_URL?.split("//")[1]} ${     media-src;
process.env.NEXT_PUBLIC_WEBSITE_URL     font-src 'self' https://maxcdn.bootstrapcdn.com https://rsms.me https://fonts.gstatic.com;  
} https://api.github.com/repos/Infisical/infisical-cli https://api.heroku.com/ https://id.heroku.com/oauth/authorize https://id.heroku.com/oauth/token https://checkout.stripe.com https://app.posthog.com https://infisical.com https://api.stripe.com https://vitals.vercel-insights.com/v1/vitals;
img-src 'self' https://*.stripe.com https://i.ytimg.com/ data:;
media-src;
font-src 'self' https://maxcdn.bootstrapcdn.com https://rsms.me https://fonts.gstatic.com;
`; `;
// You can choose which headers to add to the list // You can choose which headers to add to the list