From 002ebd46e4e97b5d8c1d92a9275061372e53e72f Mon Sep 17 00:00:00 2001
From: Evgeniy Maynagashev <lifesup@gmail.com>
Date: Mon, 29 Mar 2021 13:53:59 +0000
Subject: [PATCH] Add CSP's connect-src directive to config (#547) (#548)
---
exampleSite/config.toml | 2 ++
layouts/partials/csp.html | 2 +-
2 files changed, 3 insertions(+), 1 deletions(-)
diff --git a/exampleSite/config.toml b/exampleSite/config.toml
index fdc876f..5f1956f 100644
--- a/exampleSite/config.toml
+++ b/exampleSite/config.toml
@@ -90,6 +90,8 @@
]
scriptsrc = ["'self'", "'unsafe-inline'", "https://www.google-analytics.com"]
prefetchsrc = ["'self'"]
+# connect-src directive – defines valid targets for to XMLHttpRequest (AJAX), WebSockets or EventSource
+connectsrc = ["'self'", "https://www.google-analytics.com"]
[taxonomies]
category = "categories"
diff --git a/layouts/partials/csp.html b/layouts/partials/csp.html
index 57ded85..e9238a4 100644
--- a/layouts/partials/csp.html
+++ b/layouts/partials/csp.html
@@ -1 +1 @@
-{{ printf `<meta http-equiv="Content-Security-Policy" content="upgrade-insecure-requests; block-all-mixed-content; default-src 'self'; child-src %s; font-src %s; form-action %s; frame-src %s; img-src %s; object-src %s; style-src %s; script-src %s; prefetch-src %s;">` (delimit .Site.Params.csp.childsrc " ") (delimit .Site.Params.csp.fontsrc " ") (delimit .Site.Params.csp.formaction " ") (delimit .Site.Params.csp.framesrc " ") (delimit .Site.Params.csp.imgsrc " ") (delimit .Site.Params.csp.objectsrc " ") (delimit .Site.Params.csp.stylesrc " ") (delimit .Site.Params.csp.scriptsrc " ") (delimit .Site.Params.csp.prefetchsrc " ") | safeHTML }}
\ No newline at end of file
+{{ printf `<meta http-equiv="Content-Security-Policy" content="upgrade-insecure-requests; block-all-mixed-content; default-src 'self'; child-src %s; font-src %s; form-action %s; frame-src %s; img-src %s; object-src %s; style-src %s; script-src %s; prefetch-src %s; connect-src %s;">` (delimit .Site.Params.csp.childsrc " ") (delimit .Site.Params.csp.fontsrc " ") (delimit .Site.Params.csp.formaction " ") (delimit .Site.Params.csp.framesrc " ") (delimit .Site.Params.csp.imgsrc " ") (delimit .Site.Params.csp.objectsrc " ") (delimit .Site.Params.csp.stylesrc " ") (delimit .Site.Params.csp.scriptsrc " ") (delimit .Site.Params.csp.prefetchsrc " ") (delimit .Site.Params.csp.connectsrc " ") | safeHTML }}
--
Gitblit v1.10.0