connect-src: allow https://openvibe.chat for the navbar's Messages count (#254)

OP OpenVibers committed 6 days ago · d269f02756 · 1 file, +2 −1

Changes

ddiff --git a/server/home.js b/server/home.js
iindex cf9590f..ca1b405 100644
---- a/server/home.js
++++ b/server/home.js
@@@ -44,7 +44,8 @@ const HOME_CSP = [
      "style-src 'self' 'unsafe-inline' https://openvibe.network https://fonts.googleapis.com https://cdnjs.cloudflare.com",
      "font-src 'self' data: https://fonts.gstatic.com https://cdnjs.cloudflare.com",
      "img-src 'self' data: https:",
--    "connect-src 'self' https://openvibe.network https://openvibe.events https://cloudflareinsights.com",
++    // The navbar's Messages count asks Chat (openvibe-shared 4.130.0).
++    "connect-src 'self' https://openvibe.chat https://openvibe.network https://openvibe.events https://cloudflareinsights.com",
      "frame-src 'self' https://openvibe.network",
      "frame-ancestors 'none'",
      "object-src 'none'",