Infrastructure/logto
0
Fork 0
mirror of https://github.com/logto-io/logto.git synced 2024-12-16 20:26:19 -05:00
Code Issues Activity

fix(core): allow ui unsafe inline script (#4497)

Browse source 
fix(core): all ui unsafe inline

all ui unsafe inline
This commit is contained in:
simeng-li 2023-09-15 10:22:13 +08:00 committed by GitHub
parent 926da108e8
commit 5556a73b0a
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
1 changed files with 2 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
packages/core/src/middleware/koa-security-headers.ts
View file

@ -80,7 +80,8 @@ export default function koaSecurityHeaders<StateT, ContextT, ResponseBodyT>(
// Non-production environment allow "unsafe-eval" and "unsafe-inline" for debugging purpose
scriptSrc: [
"'self'",
...conditionalArray(!isProduction && ["'unsafe-eval'", "'unsafe-inline'"]),
"'unsafe-inline'",
...conditionalArray(!isProduction && "'unsafe-eval'"),
],
connectSrc: ["'self'", tenantEndpointOrigin, ...developmentOrigins, ...appInsightsOrigins],
// WARNING: high risk Need to allow self hosted terms of use page loaded in an iframe