fix(docs): Fix Content-Security-Policy (CSP) rules for website (#4567)

runatlantis · May 15, 2024 · 602a30a · 602a30a
1 parent 6c3b17c
commit 602a30a
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/netlify.toml b/netlify.toml
@@ -21,7 +21,7 @@
   [headers.values]
     X-Frame-Options = "DENY"
     X-XSS-Protection = "1; mode=block"
-    Content-Security-Policy = "default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; font-src 'self' data:"
+    Content-Security-Policy = "default-src 'self'; frame-src 'self' https://app.netlify.com; script-src 'self' https://*.google-analytics.com https://www.googletagmanager.com https://*.algolianet.com https://*.algolia.net 'unsafe-inline'; style-src 'self' https://fonts.googleapis.com https://*.algolianet.com https://*.algolia.net 'unsafe-inline'; img-src 'self' https://*.google-analytics.com data:; font-src 'self' data: https://fonts.googleapis.com https://fonts.gstatic.com; connect-src 'self' https://*.google-analytics.com https://www.googletagmanager.com https://*.algolianet.com https://*.algolia.net"
     Cache-Control = "public, max-age=86400, must-revalidate"
     Strict-Transport-Security = "max-age=86400; includeSubDomains; preload"
     Referrer-Policy = "no-referrer"