The page prefetch runs on openvibe.chat: inline speculation rules allowed beside the nonce (#324)

OP OpenVibers committed 12 days ago · abd94ca486 · 1 file, +2 −1

Changes

ddiff --git a/server/web/layout.js b/server/web/layout.js
iindex dd1aa37..18ec5e1 100644
---- a/server/web/layout.js
++++ b/server/web/layout.js
@@@ -81,7 +81,8 @@ function navConfig(o, config) {
  function contentSecurityPolicy(nonce) {
      return [
          "default-src 'self'",
--        `script-src 'self' 'nonce-${nonce}' https://static.cloudflareinsights.com`,
++        // 'inline-speculation-rules': the shared navbar's prefetch rules (Shared 4.70) run under the nonce policy too.
++        `script-src 'self' 'nonce-${nonce}' 'inline-speculation-rules' https://static.cloudflareinsights.com`,
          "style-src 'self' 'unsafe-inline'",
          "img-src 'self' data: blob: https:",
          "media-src 'self' blob: https:",