f1d936198e
* Feat: Initial backend view * Feat: Refactor frame runner * Feat: backend challenge submit runs tests * Feat: Backend challenge request * Feat: Whitelist hyperdev in csp * Fix: Use app tests instead of challenge tests * Feat: Allow hyperdev subdomains * Fix(csp): allow hypderdev.space subdomains * feat(challenge): submit backend * feat: Add timeout to test runner (5 sec) * chore(seed): Add more to test backend * fix(csp): s/hyperdev/gomix/g * fix(app): fix code mirror skeleton filepath * fix(app): remove Gitter saga import * fix(app): codemirrorskeleton does not need it's own folder fix(app): cmk needs to work with Null types * fix: No longer restart the browser when challenges change * fix(app): Update jquery for challenges * fix(seed): Remove to promise jquery call * fix(lint): Undo merge error undefined is no allowed * fix(app): linting errors due to bad merge * fix(seed): Remove old seed file
93 lines
2.3 KiB
JavaScript
93 lines
2.3 KiB
JavaScript
import helmet from 'helmet';
|
|
|
|
let trusted = [
|
|
"'self'"
|
|
];
|
|
|
|
if (process.env.NODE_ENV !== 'production') {
|
|
trusted = trusted.concat([
|
|
'ws://localhost:3000'
|
|
]);
|
|
}
|
|
|
|
export default function csp() {
|
|
return helmet.contentSecurityPolicy({
|
|
directives: {
|
|
defaultSrc: trusted.concat([
|
|
'https://*.cloudflare.com',
|
|
'*.cloudflare.com',
|
|
'https://*.optimizely.com'
|
|
]),
|
|
connectSrc: trusted.concat([
|
|
'https://gomix.com',
|
|
'https://*.gomix.com',
|
|
'https://*.gomix.me',
|
|
'https://*.cloudflare.com'
|
|
]),
|
|
scriptSrc: [
|
|
"'unsafe-eval'",
|
|
"'unsafe-inline'",
|
|
'*.google-analytics.com',
|
|
'*.gstatic.com',
|
|
'https://*.cloudflare.com',
|
|
'*.cloudflare.com',
|
|
'https://*.gitter.im',
|
|
'https://*.cdnjs.com',
|
|
'*.cdnjs.com',
|
|
'https://*.jsdelivr.com',
|
|
'*.jsdelivr.com',
|
|
'*.twimg.com',
|
|
'https://*.twimg.com',
|
|
'*.youtube.com',
|
|
'*.ytimg.com',
|
|
'https://*.optimizely.com'
|
|
].concat(trusted),
|
|
styleSrc: [
|
|
"'unsafe-inline'",
|
|
'*.gstatic.com',
|
|
'*.googleapis.com',
|
|
'*.bootstrapcdn.com',
|
|
'https://*.bootstrapcdn.com',
|
|
'*.cloudflare.com',
|
|
'https://*.cloudflare.com',
|
|
'https://*.optimizely.com'
|
|
].concat(trusted),
|
|
fontSrc: [
|
|
'*.cloudflare.com',
|
|
'https://*.cloudflare.com',
|
|
'*.bootstrapcdn.com',
|
|
'*.googleapis.com',
|
|
'*.gstatic.com',
|
|
'https://*.bootstrapcdn.com',
|
|
'https://*.optimizely.com'
|
|
].concat(trusted),
|
|
imgSrc: [
|
|
// allow all input since we have user submitted images for
|
|
// public profile
|
|
'*',
|
|
'data:'
|
|
],
|
|
mediaSrc: [
|
|
'*.bitly.com',
|
|
'*.amazonaws.com',
|
|
'*.twitter.com'
|
|
].concat(trusted),
|
|
frameSrc: [
|
|
'*.gitter.im',
|
|
'*.gitter.im https:',
|
|
'*.youtube.com',
|
|
'*.twitter.com',
|
|
'*.ghbtns.com',
|
|
'*.freecatphotoapp.com',
|
|
'freecodecamp.github.io'
|
|
].concat(trusted)
|
|
},
|
|
// set to true if you only want to report errors
|
|
reportOnly: false,
|
|
// set to true if you want to set all headers
|
|
setAllHeaders: false,
|
|
// set to true if you want to force buggy CSP in Safari 5
|
|
safari5: false
|
|
});
|
|
}
|