fix(csp): 🐛 use https src rule even behind a proxy

2024-07-09 14:19:15 +02:00 · 2024-07-09 14:19:15 +02:00 · 3dd4f2cc21
parent 494c6b3a9f
commit 3dd4f2cc21
1 changed files with 1 additions and 1 deletions
--- a/src/csp/middleware.ts
+++ b/src/csp/middleware.ts
@ -15,7 +15,7 @@ export function useCsp(
        frameAncestors: ["'none'"],
        upgradeInsecureRequests: true,
        styleSrc: [...trustedDomains, "'unsafe-inline'"], //set nonce to inline script
-        manifestSrc: [`${ctx.url.origin}/manifest.json`],
+        manifestSrc: [`${ctx.url.origin.replace('http:', 'https:')}/manifest.json`],
        baseUri: ["'none'"],
        imgSrc: [
            ...trustedDomains,