add missing site to CSP headers

paskal · Jan 5, 2024 · 30dcede · 30dcede
1 parent e7b3ae9
commit 30dcede
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/config/nginx/security_headers.conf b/config/nginx/security_headers.conf
@@ -17,4 +17,4 @@ add_header Strict-Transport-Security 'max-age=31536000; includeSubdomains; prelo
 add_header Referrer-Policy same-origin;
 
 # CSP header
-add_header Content-Security-Policy "default-src 'self' https://static.cdn-favor-group.ru https://dev.cdn-favor-group.ru https://fonts.bitrix24.ru/ https://fs-group.bitrix24.ru 'unsafe-inline'; connect-src 'self' https://api.clickfraud.dev https://mc.yandex.com https://mc.yandex.ru https://*.google.com https://*.google.ru https://stats.g.doubleclick.net https://*.clickfraud.ru; font-src data: https://fonts.bitrix24.ru https://static.cdn-favor-group.ru https://dev.cdn-favor-group.ru; frame-src https://mc.yandex.ru https://yandex.ru https://www.google.com; img-src 'self' data: https://*.yandex.com https://*.yandex.ru https://*.yandex.net https://www.googletagmanager.com https://*.google.ru https://static.cdn-favor-group.ru https://dev.cdn-favor-group.ru https://counter.yadro.ru; script-src 'self' https://static.cdn-favor-group.ru https://dev.cdn-favor-group.ru https://widgets.mango-office.ru/ https://dct.mango-office.ru https://www.googletagmanager.com https://cdn-ru.bitrix24.ru/ https://*.clickfraud.ru https://www.google.com https://*.yandex.ru https://*.yandex.net https://fs-group.bitrix24.ru https://cdn.jsdelivr.net https://www.gstatic.com https://cdnjs.cloudflare.com 'unsafe-inline' 'unsafe-eval'; object-src 'none'" always;
+add_header Content-Security-Policy "default-src 'self' https://static.cdn-favor-group.ru https://dev.cdn-favor-group.ru https://fonts.bitrix24.ru/ https://fs-group.bitrix24.ru 'unsafe-inline'; connect-src 'self' https://api.clickfraud.dev https://mc.yandex.com https://mc.yandex.ru https://*.google.com https://*.google.ru https://stats.g.doubleclick.net https://*.clickfraud.ru https://analytics.bitrix.info; font-src data: https://fonts.bitrix24.ru https://static.cdn-favor-group.ru https://dev.cdn-favor-group.ru; frame-src https://mc.yandex.ru https://yandex.ru https://www.google.com; img-src 'self' data: https://*.yandex.com https://*.yandex.ru https://*.yandex.net https://www.googletagmanager.com https://*.google.ru https://static.cdn-favor-group.ru https://dev.cdn-favor-group.ru https://counter.yadro.ru; script-src 'self' https://static.cdn-favor-group.ru https://dev.cdn-favor-group.ru https://widgets.mango-office.ru/ https://dct.mango-office.ru https://www.googletagmanager.com https://cdn-ru.bitrix24.ru/ https://*.clickfraud.ru https://www.google.com https://*.yandex.ru https://*.yandex.net https://fs-group.bitrix24.ru https://cdn.jsdelivr.net https://www.gstatic.com https://cdnjs.cloudflare.com 'unsafe-inline' 'unsafe-eval'; object-src 'none'" always;