Allow JSDelivr in CSP

owl-corp · Aug 19, 2024 · f126807 · f126807
1 parent d5e4477
commit f126807
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/thallium-backend/src/app.py b/thallium-backend/src/app.py
@@ -41,7 +41,7 @@ async def add_process_time_and_security_headers(
     response.headers["X-XSS-Protection"] = "1; mode=block"
     response.headers["Strict-Transport-Security"] = "max-age=31536000"
     response.headers["X-Content-Type-Options"] = "nosniff"
-    response.headers["Content-Security-Policy"] = "default-src 'self'"
+    response.headers["Content-Security-Policy"] = "default-src 'self'; script-src https://cdn.jsdelivr.net/; style-src https://cdn.jsdelivr.net/;"
     response.headers["Referrer-Policy"] = "no-referrer"
     response.headers["Permissions-Policy"] = (
         "camera=(), display-capture=(), fullscreen=(), geolocation=(), microphone=(), screen-wake-lock=(), web-share=()"