From 19493e969fd21dc1b058475810e90b6db7cda50d Mon Sep 17 00:00:00 2001 From: Jackson Harper Date: Wed, 14 Jun 2023 11:29:56 +0800 Subject: [PATCH] Add a few more CSP directives --- packages/web/next.config.js | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/packages/web/next.config.js b/packages/web/next.config.js index 1ef122c74..bbda2f6cb 100644 --- a/packages/web/next.config.js +++ b/packages/web/next.config.js @@ -2,7 +2,7 @@ const ContentSecurityPolicy = ` default-src 'none'; base-uri 'self'; block-all-mixed-content; - connect-src 'self' api-prod.omnivore.app api-demo.omnivore.app; + connect-src 'self' api-prod.omnivore.app api-demo.omnivore.app proxy-prod.omnivore-image-cache.app proxy-demo.omnivore-image-cache.app api.segment.io cdn.segment.com widget.intercom.io api-iam.intercom.io wss://nexus-websocket-a.intercom.io platform.twitter.com; font-src 'self'; form-action 'self' api-prod.omnivore.app api-demo.omnivore.app; frame-ancestors 'none'; @@ -10,6 +10,8 @@ const ContentSecurityPolicy = ` manifest-src 'self'; script-src script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; + img-src 'self'; + manifest-src 'self'; ` const moduleExports = {