feat: Update CSP in nginx config

smswithoutborders · Mar 27, 2024 · 313dee9 · 313dee9
1 parent 27d0e8e
commit 313dee9
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/nginx/nginx.conf.template b/nginx/nginx.conf.template
@@ -24,7 +24,7 @@ server {
     add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload";
     add_header X-XSS-Protection "1; mode=block";
     add_header Referrer-Policy "strict-origin";
-    add_header Content-Security-Policy "default-src 'self'; font-src *;img-src * data:; script-src *; style-src *";
+    add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://cdnjs.cloudflare.com; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://cdnjs.cloudflare.com; font-src 'self' https://fonts.gstatic.com https://cdnjs.cloudflare.com; img-src 'self' data: https://www.google-analytics.com; connect-src 'self' https://www.google-analytics.com;";
     add_header Permissions-Policy "geolocation=(),midi=(),sync-xhr=(),microphone=(),camera=(),magnetometer=(),gyroscope=(),fullscreen=(self),payment=()";
     add_header X-Frame-Options "SAMEORIGIN";
     add_header X-Content-Type-Options nosniff;