fix(security): add script-src in csp header

slater-notes · Apr 14, 2021 · 2c1e271 · 2c1e271
1 parent 9495817
commit 2c1e271
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/public/_headers b/public/_headers
@@ -1,3 +1,3 @@
 /*
   X-Frame-Options: DENY
-  Content-Security-Policy-Report-Only: default-src 'none'; style-src 'self' 'unsafe-inline'; connect-src 'self' https://us-central1-slater-notes.cloudfunctions.net; require-trusted-types-for 'script';
+  Content-Security-Policy-Report-Only: default-src 'none'; style-src 'self' 'unsafe-inline'; script-src 'self'; connect-src 'self' https://us-central1-slater-notes.cloudfunctions.net; require-trusted-types-for 'script';