cohabit/website
5
0
Fork 0
Code Issues Pull requests Actions Packages Projects Releases Wiki Activity

Compare commits

base: cohabit:3b6ec84e07cd2f68ea1ccee4a2453281db7bead4
Branches Tags
cohabit:main
..
compare: cohabit:3dd4f2cc2176028aadadf34ed5d5b3c6a3b8cb59
Branches Tags
cohabit:main

3 commits
3b6ec84e07 ... 3dd4f2cc21

Author SHA1 Message Date
Julien Oculi 3dd4f2cc21 fix(csp): 🐛 use https src rule even behind a proxy 2024-07-09 14:19:15 +02:00
Julien Oculi 494c6b3a9f feat(csp): 🔒 add "base uri" csp security options 2024-07-09 14:02:23 +02:00
Julien Oculi e4fc9d22ae fix(island): 🐛 jsr version of gfm use dynamic require of "path" and so break frontend 2024-07-09 14:01:32 +02:00
2 changed files with 3 additions and 2 deletions
Show stats Expand all files Collapse all files

2
deno.json
View file

@ -37,7 +37,7 @@
":types": "./types.ts", ":types": "./types.ts",
"@cohabit/cohamail/": "./packages/@cohabit__cohamail@0.2.1/", "@cohabit/cohamail/": "./packages/@cohabit__cohamail@0.2.1/",
"@cohabit/ressources_manager/": "./packages/@cohabit__ressources_manager@0.1.3/", "@cohabit/ressources_manager/": "./packages/@cohabit__ressources_manager@0.1.3/",
"@deno/gfm": "jsr:@deno/gfm@^0.8.2", "@deno/gfm": "https://deno.land/x/gfm@0.6.0/mod.ts",
"@jotsr/delayed": "jsr:@jotsr/delayed@^2.1.1", "@jotsr/delayed": "jsr:@jotsr/delayed@^2.1.1",
"@jotsr/smart-css-bundler": "jsr:@jotsr/smart-css-bundler@^0.3.0", "@jotsr/smart-css-bundler": "jsr:@jotsr/smart-css-bundler@^0.3.0",
"@preact/signals": "https://esm.sh/*@preact/signals@^1.2.3", "@preact/signals": "https://esm.sh/*@preact/signals@^1.2.3",

3
src/csp/middleware.ts
View file

@ -15,7 +15,8 @@ export function useCsp(
frameAncestors: ["'none'"], frameAncestors: ["'none'"],
upgradeInsecureRequests: true, upgradeInsecureRequests: true,
styleSrc: [...trustedDomains, "'unsafe-inline'"], //set nonce to inline script styleSrc: [...trustedDomains, "'unsafe-inline'"], //set nonce to inline script
manifestSrc: [`${ctx.url.origin}/manifest.json`], manifestSrc: [`${ctx.url.origin.replace('http:', 'https:')}/manifest.json`],
baseUri: ["'none'"],
imgSrc: [ imgSrc: [
...trustedDomains, ...trustedDomains,
'data:', 'data:',