fix(csp): turn useDefaults off in CSP

This commit turns the cross-site protection `useDefaults` directive to `false`. It was flipped to being true and wreaks havoc with our app.
IMA-WorldHealth · Jan 4, 2022 · d342baa · d342baa
1 parent 151638a
commit d342baa
Showing 1 changed file with 1 addition and 0 deletions.
diff --git a/server/config/express.js b/server/config/express.js
@@ -43,6 +43,7 @@ exports.configure = function configure(app) {
   // helmet guards
   app.use(helmet({
     contentSecurityPolicy : {
+      useDefaults : false,
       directives : {
         defaultSrc : ['\'self\'', '\'unsafe-inline\'', 'blob:'],
         fontSrc : ['\'self\'', 'https://fonts.gstatic.com'],