melabidi/Rental-operations-platform
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: use unsafe-inline instead of nonce in dev style-src (nonce makes unsafe-inline ignored)
CI / test (push) Failing after 38s
Details

Browse Source
This commit is contained in:
root
2026-06-25 20:18:59 -04:00
parent 20d1819621
commit a99843032f
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/lib/security/csp.ts
+1 -1
View File
@@ -9,7 +9,7 @@ export function buildContentSecurityPolicy(nonce: string, development: boolean):
const directives = [ const directives = [
"default-src 'self'", "default-src 'self'",
`script-src ${scriptSources.join(' ')}`, `script-src ${scriptSources.join(' ')}`,
`style-src 'self' 'nonce-${nonce}'${development ? " 'unsafe-inline'" : ''}`, `style-src 'self'${development ? " 'unsafe-inline'" : ` 'nonce-${nonce}'`}`,
"img-src 'self' data: blob:", "img-src 'self' data: blob:",
"font-src 'self' data:", "font-src 'self' data:",
`connect-src 'self'${development ? ' ws: wss:' : ''}`, `connect-src 'self'${development ? ' ws: wss:' : ''}`,