From babb5364a5472e9dabe0d937532bf5fc2a309238 Mon Sep 17 00:00:00 2001 From: Flam3rboy <34555296+Flam3rboy@users.noreply.github.com> Date: Wed, 5 May 2021 15:05:23 +0200 Subject: :bug: fix test client --- src/middlewares/CORS.ts | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) (limited to 'src/middlewares/CORS.ts') diff --git a/src/middlewares/CORS.ts b/src/middlewares/CORS.ts index b47de251..e6cc5544 100644 --- a/src/middlewares/CORS.ts +++ b/src/middlewares/CORS.ts @@ -4,9 +4,10 @@ import { NextFunction, Request, Response } from "express"; export function CORS(req: Request, res: Response, next: NextFunction) { res.set("Access-Control-Allow-Origin", "*"); + // TODO: use securer CSP policy res.set( "Content-security-policy", - "script-src 'https://hcaptcha.com, https://*.hcaptcha.com' frame-src 'https://hcaptcha.com, https://*.hcaptcha.com' style-src 'https://hcaptcha.com, https://*.hcaptcha.com' connect-src 'https://hcaptcha.com, https://*.hcaptcha.com'" + "default-src * data: blob: filesystem: about: ws: wss: 'unsafe-inline' 'unsafe-eval'; script-src * data: blob: 'unsafe-inline' 'unsafe-eval'; connect-src * data: blob: 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src * data: blob: ; style-src * data: blob: 'unsafe-inline'; font-src * data: blob: 'unsafe-inline';" ); res.set("Access-Control-Allow-Headers", req.header("Access-Control-Request-Headers")); -- cgit 1.5.1