fix: allow static assets from cdn.getunleash.io

Unleash · Jan 6, 2022 · 73685c7 · 73685c7 · vercel · Jan 6, 2022
1 parent 571dcf5
commit 73685c7
Showing 1 changed file with 10 additions and 3 deletions.
diff --git a/src/lib/middleware/secure-headers.ts b/src/lib/middleware/secure-headers.ts
@@ -13,21 +13,28 @@ const secureHeaders: (config: IUnleashConfig) => RequestHandler = (config) => {
             },
             contentSecurityPolicy: {
                 directives: {
-                    defaultSrc: ["'self'"],
+                    defaultSrc: ["'self'", 'cdn.getunleash.io'],
                     fontSrc: [
                         "'self'",
+                        'cdn.getunleash.io',
                         'fonts.googleapis.com',
                         'fonts.gstatic.com',
                     ],
                     styleSrc: [
                         "'self'",
                         "'unsafe-inline'",
+                        'cdn.getunleash.io',
                         'fonts.googleapis.com',
                         'fonts.gstatic.com',
                         'data:',
                     ],
-                    scriptSrc: ["'self'"],
-                    imgSrc: ["'self'", 'data:', 'gravatar.com'],
+                    scriptSrc: ["'self'", 'cdn.getunleash.io'],
+                    imgSrc: [
+                        "'self'",
+                        'data:',
+                        'cdn.getunleash.io',
+                        'gravatar.com',
+                    ],
                 },
             },
         });