gaspersic/freeCodeCamp
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

Merge pull request #11371 from ivantedja/fix/optimizely-csp

Browse Source 
fix optimizely csp for script-src
This commit is contained in:
Berkeley Martinez
2016-10-27 08:00:42 -07:00
committed by GitHub
parent a33e34f942 59a0788dfa
commit 03c222d3bd
1 changed files with 8 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
server/middlewares/csp.js
View File

@ -14,9 +14,9 @@ export default function csp() {
return helmet.contentSecurityPolicy({
directives: {
defaultSrc: trusted.concat([
'*.optimizely.com',
'https://*.cloudflare.com',
'*.cloudflare.com'
'*.cloudflare.com',
'https://*.optimizely.com'
]),
scriptSrc: [
"'unsafe-eval'",
@ -33,7 +33,8 @@ export default function csp() {
'*.twimg.com',
'https://*.twimg.com',
'*.youtube.com',
'*.ytimg.com'
'*.ytimg.com',
'https://*.optimizely.com'
].concat(trusted),
styleSrc: [
"'unsafe-inline'",
@ -42,7 +43,8 @@ export default function csp() {
'*.bootstrapcdn.com',
'https://*.bootstrapcdn.com',
'*.cloudflare.com',
'https://*.cloudflare.com'
'https://*.cloudflare.com',
'https://*.optimizely.com'
].concat(trusted),
fontSrc: [
'*.cloudflare.com',
@ -50,7 +52,8 @@ export default function csp() {
'*.bootstrapcdn.com',
'*.googleapis.com',
'*.gstatic.com',
'https://*.bootstrapcdn.com'
'https://*.bootstrapcdn.com',
'https://*.optimizely.com'
].concat(trusted),
imgSrc: [
// allow all input since we have user submitted images for