fix(web): 🐛 allow csp manifest-src

collinbarrett · Jan 24, 2021 · 4be1823 · 4be1823
1 parent 4aa6845
commit 4be1823
Show file tree

Hide file tree

Showing 2 changed files with 3 additions and 3 deletions.
diff --git a/reverse-proxy/conf.d.dev/default.conf b/reverse-proxy/conf.d.dev/default.conf
@@ -20,6 +20,6 @@ server {
     rewrite    ^/api/(.*)$ /$1 break;
     proxy_pass http://api-docs:8080;
     include    location-includes/*;
-    add_header Content-Security-Policy "default-src 'none'; base-uri 'self'; frame-ancestors 'self'; form-action 'none'; script-src 'self' 'unsafe-inline'; connect-src 'self'; img-src 'self' validator.swagger.io data:; style-src 'self' 'unsafe-inline';" always;
+    add_header Content-Security-Policy "default-src 'none'; base-uri 'self'; frame-ancestors 'self'; form-action 'none'; connect-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' validator.swagger.io data:;" always;
   }
 }
diff --git a/reverse-proxy/conf.d/default.conf b/reverse-proxy/conf.d/default.conf
@@ -23,13 +23,13 @@ server {
     rewrite    ^/api/(.*)$ /$1 break;
     proxy_pass http://api-docs:8080;
     include    location-includes/*;
-    add_header Content-Security-Policy "default-src 'none'; base-uri 'self'; frame-ancestors 'self'; form-action 'none'; script-src 'self' 'unsafe-inline'; connect-src 'self'; img-src 'self' validator.swagger.io data:; style-src 'self' 'unsafe-inline';" always;
+    add_header Content-Security-Policy "default-src 'none'; base-uri 'self'; frame-ancestors 'self'; form-action 'none'; connect-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' validator.swagger.io data:;" always;
   }
 
   location / {
     proxy_pass http://web:80;
     include    location-includes/*;
-    add_header Content-Security-Policy "default-src 'none'; base-uri 'self'; frame-ancestors 'self'; form-action 'none'; script-src 'self'; connect-src 'self'; img-src 'self' data:; style-src 'self';" always;
+    add_header Content-Security-Policy "default-src 'none'; base-uri 'self'; frame-ancestors 'self'; form-action 'none'; connect-src 'self'; script-src 'self'; style-src 'self'; img-src 'self' data:; manifest-src 'self';" always;
   }
 }