gaspersic/freeCodeCamp
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

fix(csp): add optimizely for csp errors in production

Browse Source 
This commit fixes the issues with optimizely scripts and bring the
file in sync with the staging.
This commit is contained in:
Mrugesh Mohapatra
2016-12-06 12:07:01 +00:00
parent 687050e7f2
commit 94bc4d310e
1 changed files with 14 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

19
server/middlewares/csp.js
View File

@ -5,13 +5,19 @@ let trusted = [
]; ];
if (process.env.NODE_ENV !== 'production') { if (process.env.NODE_ENV !== 'production') {
trusted.push('ws://localhost:3001'); trusted = trusted.concat([
'ws://localhost:3000'
]);
} }
export default function csp() { export default function csp() {
return helmet.contentSecurityPolicy({ return helmet.contentSecurityPolicy({
directives: { directives: {
defaultSrc: trusted.concat('*.optimizely.com'), defaultSrc: trusted.concat([
'https://*.cloudflare.com',
'*.cloudflare.com',
'https://*.optimizely.com'
]),
scriptSrc: [ scriptSrc: [
"'unsafe-eval'", "'unsafe-eval'",
"'unsafe-inline'", "'unsafe-inline'",
@ -27,7 +33,8 @@ export default function csp() {
'*.twimg.com', '*.twimg.com',
'https://*.twimg.com', 'https://*.twimg.com',
'*.youtube.com', '*.youtube.com',
'*.ytimg.com' '*.ytimg.com',
'https://*.optimizely.com'
].concat(trusted), ].concat(trusted),
styleSrc: [ styleSrc: [
"'unsafe-inline'", "'unsafe-inline'",
@ -36,7 +43,8 @@ export default function csp() {
'*.bootstrapcdn.com', '*.bootstrapcdn.com',
'https://*.bootstrapcdn.com', 'https://*.bootstrapcdn.com',
'*.cloudflare.com', '*.cloudflare.com',
'https://*.cloudflare.com' 'https://*.cloudflare.com',
'https://*.optimizely.com'
].concat(trusted), ].concat(trusted),
fontSrc: [ fontSrc: [
'*.cloudflare.com', '*.cloudflare.com',
@ -44,7 +52,8 @@ export default function csp() {
'*.bootstrapcdn.com', '*.bootstrapcdn.com',
'*.googleapis.com', '*.googleapis.com',
'*.gstatic.com', '*.gstatic.com',
'https://*.bootstrapcdn.com' 'https://*.bootstrapcdn.com',
'https://*.optimizely.com'
].concat(trusted), ].concat(trusted),
imgSrc: [ imgSrc: [
// allow all input since we have user submitted images for // allow all input since we have user submitted images for