bert.hausmans
b5fcb7c14a
Vuexy loads fonts via webfontloader from fonts.googleapis.com and fonts.gstatic.com. The previous CSP blocked these, causing a white screen. - style-src: added https://fonts.googleapis.com - font-src: added https://fonts.gstatic.com - Removed frame-ancestors from meta tags (ignored in meta, console warnings) Updated in all three index.html dev meta tags and both Nginx SPA/portal configs. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
5 lines
451 B
Plaintext
5 lines
451 B
Plaintext
# CSP for portal.crewli.app
|
|
# Same policy as SPA but with stricter connect-src since portal
|
|
# should only talk to the API.
|
|
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; img-src 'self' data: https:; font-src 'self' data: https://fonts.gstatic.com; connect-src 'self' https://api.crewli.app; frame-ancestors 'none'; form-action 'self'; base-uri 'self'" always;
|