add connect-src csp

ideacrew · Apr 8, 2024 · c7ceed9 · c7ceed9
1 parent 4a1b8aa
commit c7ceed9
Showing 1 changed file with 2 additions and 1 deletion.
diff --git a/.docker/config/nginx.conf b/.docker/config/nginx.conf
@@ -29,7 +29,8 @@ server {
    set $csp "${csp} script-src 'self' 'unsafe-inline' https https://tagmanager.google.com https://www.googletagmanager.com https://apps.usw2.pure.cloud *.fontawesome.com *.google-analytics.com;";
    set $csp "${csp} style-src 'self' 'unsafe-inline' https https://tagmanager.google.com https://www.googletagmanager.com https://fonts.googleapis.com *.fontawesome.com;";
    set $csp "${csp} style-src-elem 'self' 'unsafe-inline' https https://fonts.googleapis.com;";
-   set $csp "${csp} font-src 'self' *.gstatic.com  *.fontawesome.com";
+   set $csp "${csp} font-src 'self' *.gstatic.com  *.fontawesome.com;";
+   set $csp "${csp} connect-src 'self' https://*.cme.openhbx.org";
 
    more_set_headers "Content-Security-Policy: ${csp}";
    more_set_headers "Strict-Transport-Security: max-age=31536000; includeSubDomains";