diff options
Diffstat (limited to 'lib')
| -rw-r--r-- | lib/config/default.js | 10 | ||||
| -rw-r--r-- | lib/config/environment.js | 3 |
2 files changed, 4 insertions, 9 deletions
diff --git a/lib/config/default.js b/lib/config/default.js index 0b6ca26a..cfde9ae9 100644 --- a/lib/config/default.js +++ b/lib/config/default.js @@ -15,17 +15,9 @@ module.exports = { }, csp: { enable: true, - reportUri: '', directives: { - defaultSrc: ["'self'"], - scriptSrc: ["'self'", "'unsafe-eval'", "vimeo.com", "https://gist.github.com", "www.slideshare.net", "https://query.yahooapis.com", "https://*.disqus.com"], - imgSrc: ["*"], - styleSrc: ["'self'", "'unsafe-inline'", "https://assets-cdn.github.com"], - fontSrc: ["'self'", "https://public.slidesharecdn.com"], - objectSrc: ["*"], - childSrc: ["*"], - connectSrc: ["'self'", "https://links.services.disqus.com", "wss://realtime.services.disqus.com"] }, + addDefaults: true, upgradeInsecureRequests: 'auto' }, protocolusessl: false, diff --git a/lib/config/environment.js b/lib/config/environment.js index 40b7e09f..fa9698f6 100644 --- a/lib/config/environment.js +++ b/lib/config/environment.js @@ -14,6 +14,9 @@ module.exports = { includeSubdomains: toBooleanConfig(process.env.HMD_HSTS_INCLUDE_SUBDOMAINS), preload: toBooleanConfig(process.env.HMD_HSTS_PRELOAD) }, + csp: { + enable: toBooleanConfig(process.env.HMD_CSP_ENABLE) + }, protocolusessl: toBooleanConfig(process.env.HMD_PROTOCOL_USESSL), alloworigin: process.env.HMD_ALLOW_ORIGIN ? process.env.HMD_ALLOW_ORIGIN.split(',') : undefined, usecdn: toBooleanConfig(process.env.HMD_USECDN), |