gaspersic/freeCodeCamp
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

fixed helmet related errors

Browse Source
This commit is contained in:
Michael Q Larson
2014-12-22 12:36:45 -08:00
parent ffddd86022
commit 9849acd49e
1 changed files with 19 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

25
app.js
View File

@ -92,14 +92,27 @@ app.use(flash());
app.disable('x-powered-by'); app.disable('x-powered-by');
app.use(helmet.xssFilter()); app.use(helmet.xssFilter());
app.use(helmet.xframe()); app.use(helmet.xframe());
var trusted = [
"'self'",
'*.freecodecamp.com',
"*.google-analytics.com",
"*.googleapis.com",
"*.gstatic.com",
"*.doubleclick.net",
"*.twitter.com",
'*.twimg.com',
"*.githubusercontent.com",
"'unsafe-eval'",
"'unsafe-inline'"
];
app.use(helmet.contentSecurityPolicy({ app.use(helmet.contentSecurityPolicy({
defaultSrc: ["'self'", 'freecodecamp.com'], defaultSrc: trusted,
scriptSrc: ['*.google-analytics.com', '*.optimizely.com', '*.googleapis.com', '*.twitter.com'], scriptSrc: ['*.optimizely.com'].concat(trusted),
styleSrc: ["'self'", '*.twitter.com'], styleSrc: trusted,
imgSrc: ["'self'", '*.amazonaws.com', '*.twitter.com', '*.twimg.com'], imgSrc: ['*.evernote.com', '*.amazonaws.com', "data:"].concat(trusted),
fontSrc: ["'self", '*.googleapis.com', '*.twitter.com'], fontSrc: ["'self", '*.googleapis.com'].concat(trusted),
mediaSrc: ['*.amazonaws.com', '*.twitter'], mediaSrc: ['*.amazonaws.com', '*.twitter'],
frameSrc: ['*.gitter.im', '*.vimeo.com'], frameSrc: ['*.gitter.im', '*.vimeo.com', '*.twitter.com'],
// sandbox: ['allow-forms', 'allow-scripts'], // sandbox: ['allow-forms', 'allow-scripts'],
// reportUri: '/report-violation', // reportUri: '/report-violation',
reportOnly: false, // set to true if you only want to report errors reportOnly: false, // set to true if you only want to report errors