Allow 'self' for img-src and connect-src

Apparently, there is a bug for Chrome on iOS if connect-src does not allow 'self'. See known issues at https://caniuse.com/contentsecuritypolicy
stackernews · Feb 9, 2024 · 8a2ff99 · 8a2ff99
1 parent e2de56d
commit 8a2ff99
Showing 1 changed file with 2 additions and 2 deletions.
diff --git a/middleware.js b/middleware.js
@@ -22,11 +22,11 @@ export function middleware (request) {
   const cspHeader = [
     "default-src 'none'",
     "font-src 'self'",
-    'img-src https: data:',
+    "img-src 'self' https: data:",
     "script-src 'self' 'unsafe-inline' 'unsafe-eval'",
     "style-src 'self' 'unsafe-inline'",
     "manifest-src 'self'",
-    'connect-src https: wss:',
+    "connect-src 'self' https: wss:",
     'upgrade-insecure-requests'
   ].join('; ')