From 1cab51249ecfb1c5e4902ed3eda2156eccca2f92 Mon Sep 17 00:00:00 2001 From: Bruno Windels Date: Thu, 4 Feb 2021 11:31:42 +0100 Subject: [PATCH] use same csp header for local dev as matrix.to --- scripts/serve-local.js | 2 ++ 1 file changed, 2 insertions(+) diff --git a/scripts/serve-local.js b/scripts/serve-local.js index 02581f9..08e500d 100644 --- a/scripts/serve-local.js +++ b/scripts/serve-local.js @@ -30,6 +30,8 @@ const serve = serveStatic( res.setHeader("Pragma", "no-cache"); res.setHeader("Cache-Control", "no-cache, no-store, must-revalidate"); res.setHeader("Expires", "Wed, 21 Oct 2015 07:28:00 GMT"); + // same CSP as matrix.to server is using, so local testing happens under similar environment + res.setHeader("Content-Security-Policy", "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline'; img-src * data:; connect-src *; font-src 'self'; manifest-src 'self'; form-action 'self'; navigate-to *;"); }, index: ['index.html', 'index.htm'] }