Infrastructure/logto
0
Fork 0
mirror of https://github.com/logto-io/logto.git synced 2025-02-17 22:04:19 -05:00
Code Issues Activity

fix(core,ui): clear ui preload link not used warning (#4429)

Browse source 
fix(core,ui): address ui preload link not used warning

address ui preload link not used warning
This commit is contained in:
simeng-li 2023-09-06 09:55:22 +08:00 • committed by GitHub
parent 90ea2e2f71
commit 5e8b1bd598
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
2 changed files with 25 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

8
packages/core/src/middleware/koa-security-headers.ts
View file

@ -106,7 +106,13 @@ export default function koaSecurityHeaders<StateT, ContextT, ResponseBodyT>(
"'self'",
...conditionalArray(!isProduction && ["'unsafe-eval'", "'unsafe-inline'"]),
],
connectSrc: ["'self'", ...adminOrigins, ...coreOrigins, ...developmentOrigins],
connectSrc: [
"'self'",
...adminOrigins,
...coreOrigins,
...developmentOrigins,
...appInsightsOrigins,
],
// Allow Main Flow origin loaded in preview iframe
frameSrc: ["'self'", ...adminOrigins, ...coreOrigins],
},

20
packages/ui/src/index.html
View file

@ -5,8 +5,24 @@
<meta charset="utf-8" />
<meta name="viewport" content="width=device-width, initial-scale=1.0, viewport-fit=cover">
<title></title>
<link rel="preload" href="/api/.well-known/sign-in-exp" as="fetch" crossorigin="anonymous">
<link rel="preload" href="/api/.well-known/phrases" as="fetch" crossorigin="anonymous">
<!--Preload well-known settings API-->
<script>
const { search } = window.location;
const noCache = search.includes('no_cache');
const isPreview = search.includes('preview');
// Preview mode does not query sign-in-exp and phrases
const preLoadLinks = isPreview ? [] : ['/api/.well-known/sign-in-exp', '/api/.well-known/phrases'];
// Append preload well-known settings API links to head
preLoadLinks.forEach((linkUrl) => {
const link = document.createElement('link');
link.rel = 'preload';
link.href = `${linkUrl}${noCache ? '?no_cache=true' : ''}`;
link.as = 'fetch';
link.crossOrigin = 'anonymous';
document.head.appendChild(link);
});
</script>
</head>
<body>