fixing CSP - SWs use connect-src to validate CSP

DerLev · Apr 23, 2024 · 926fb2a · 926fb2a
1 parent 325027d
commit 926fb2a
Show file tree

Hide file tree

Showing 2 changed files with 2 additions and 2 deletions.
diff --git a/homepage/firebase.json b/homepage/firebase.json
@@ -21,7 +21,7 @@
         "source": "**",
         "headers": [{
           "key": "Content-Security-Policy",
-          "value": "script-src 'self'; style-src 'self' https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.com; default-src 'self'"
+          "value": "script-src 'self'; style-src 'self' https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.com; connect-src 'self' https://fonts.googleapis.com https://fonts.gstatic.com; default-src 'self'"
         }]
       }
     ]

diff --git a/homepage/hugo.toml b/homepage/hugo.toml
@@ -63,4 +63,4 @@ enableGitInfo = true
   [[server.headers]]
     for = '/**'
     [server.headers.values]
-      Content-Security-Policy = "script-src 'self'; style-src 'self' https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.com; default-src 'self'"
+      Content-Security-Policy = "script-src 'self'; style-src 'self' https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.com; connect-src 'self' https://fonts.googleapis.com https://fonts.gstatic.com; default-src 'self'"