Merge pull request #30 from raferdev/development

fix(nginx): add image 'data:' CSP rule
raferdev · Nov 16, 2023 · 91dd8ce · 91dd8ce
2 parents ae9cc2c + 7f4a3ab
commit 91dd8ce
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/nginx/nginx.conf b/nginx/nginx.conf
@@ -11,7 +11,7 @@ http {
 
   add_header X-Frame-Options "SAMEORIGIN";
   add_header X-XSS-Protection "1; mode=block";
-  add_header Content-Security-Policy "worker-src blob:; script-src 'self' 'unsafe-inline' 'unsafe-eval' *.googletagmanager.com *.datadoghq-browser-agent.com; frame-src 'self' *.youtube.com; object-src 'none'; base-uri 'self'; form-action 'none'; frame-ancestors 'none'; img-src 'self'; font-src 'self'; manifest-src 'self';";
+  add_header Content-Security-Policy "worker-src blob:; script-src 'self' 'unsafe-inline' 'unsafe-eval' *.googletagmanager.com *.datadoghq-browser-agent.com; frame-src 'self' *.youtube.com; object-src 'none'; base-uri 'self'; form-action 'none'; frame-ancestors 'self'; img-src 'self' data:; font-src 'self'; manifest-src 'self';";
   add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload";
   add_header Referrer-Policy "strict-origin";
   add_header Permissions-Policy "geolocation=(self),midi=(),sync-xhr=(),microphone=(),camera=(),magnetometer=(),gyroscope=(),fullscreen=(),payment=()";