feat: added csp headers

powerhouse-inc · May 14, 2024 · 9915d85 · 9915d85
1 parent 3d497da
commit 9915d85
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/nginx.conf b/nginx.conf
@@ -12,7 +12,7 @@ server {
     add_header X-XSS-Protection "1; mode=block";
     add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
     add_header Referrer-Policy "no-referrer-when-downgrade";
-    add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https:; object-src 'none';";
+    add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https:; worker-src 'self' blob: https://apps.powerhouse.io; connect-src 'self' https://*.sentry.io; img-src 'self' data:; object-src 'none'; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; font-src 'self' data: https://fonts.googleapis.com";
 
     # Gzip Settings
     gzip on;