From a523a5b9375c681613b0b354b8af7aae63dff6c1 Mon Sep 17 00:00:00 2001 From: Polybius93 Date: Tue, 18 Feb 2025 09:38:05 +0100 Subject: [PATCH] fix: modify headers values to be less strict --- netlify.toml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/netlify.toml b/netlify.toml index 0a604a3..ac81a92 100644 --- a/netlify.toml +++ b/netlify.toml @@ -10,7 +10,7 @@ for = "/*" [headers.values] - Content-Security-Policy = "default-src 'self'; connect-src 'self' *; base-uri 'none'; form-action 'self'; frame-ancestors 'none'; img-src 'self' https: data:; media-src 'self'; object-src 'none'; script-src 'self' 'unsafe-inline' 'unsafe-eval' http://www.youtube.com https://www.youtube.com https://s.ytimg.com; frame-src 'self' http://www.youtube.com https://www.youtube.com; style-src 'self' 'unsafe-inline'" + Content-Security-Policy = "default-src 'self'; connect-src 'self' https: wss:; base-uri 'self'; form-action 'self'; frame-ancestors 'none'; img-src 'self' https: data:; media-src 'self'; object-src 'none'; script-src 'self' 'unsafe-inline' 'unsafe-eval' http: https:; frame-src 'self' http: https:; style-src 'self' 'unsafe-inline'" Referrer-Policy = "strict-origin-when-cross-origin" Strict-Transport-Security = "max-age=31536000; includeSubDomains" X-Content-Type-Options = "nosniff"