Merge branch 'csp-remote-media' into 'develop'

csp: load any media over https, not just local media

See merge request soapbox-pub/ditto!41
This commit is contained in:
Alex Gleason 2023-09-11 20:18:51 +00:00
commit 34b022ea51
1 changed files with 2 additions and 2 deletions

View File

@ -10,8 +10,8 @@ const csp = (): AppMiddleware => {
'upgrade-insecure-requests',
`script-src 'self'`,
`connect-src 'self' blob: ${Conf.localDomain} ${wsProtocol}//${host}`,
`media-src 'self' ${Conf.mediaDomain}`,
`img-src 'self' data: blob: ${Conf.mediaDomain}`,
`media-src 'self' https:`,
`img-src 'self' data: blob: https:`,
`default-src 'none'`,
`base-uri 'self'`,
`frame-ancestors 'none'`,