fix: update Content Security Policy to allow Cloudflare Turnstile scripts

2025-12-06 15:03:36 +01:00
parent 68f8322221
commit dc6b3b30d0
1 changed files with 3 additions and 3 deletions
--- a/backend/src/app.js
+++ b/backend/src/app.js
@@ -18,13 +18,13 @@ app.use(helmet({
    directives: {
      defaultSrc: ["'self'"],
      styleSrc: ["'self'", "'unsafe-inline'", "https://ui-avatars.com"],
-      scriptSrc: ["'self'"],
+      scriptSrc: ["'self'", "https://challenges.cloudflare.com"],
      imgSrc: ["'self'", "data:", "https:", "https://ui-avatars.com"],
-      connectSrc: ["'self'"],
+      connectSrc: ["'self'", "https://challenges.cloudflare.com"],
      fontSrc: ["'self'"],
      objectSrc: ["'none'"],
      mediaSrc: ["'self'"],
-      frameSrc: ["'none'"],
+      frameSrc: ["'self'", "https://challenges.cloudflare.com"],
    },
  },
  hsts: {