openvibers/openvibe.run Commits

openvibe.run's CSP allows Cloudflare Web Analytics' beacon (it was refused in every visitor's console) (#68)

OP OpenVibers committed 20 days ago · e82bbe097f · 1 file, +2 −2

Changes

ddiff --git a/server/web/home.js b/server/web/home.js
iindex d1f8d23..8be6376 100644
---- a/server/web/home.js
++++ b/server/web/home.js
@@@ -28,12 +28,12 @@ const DESCRIPTION = 'Run jobs on your own machine or on a node that can: one API
const HOME_CSP = [
"default-src 'self'",
// The Frame's theme-loader, navbar and footer are served from /shared; the inline boot is the shell's.
-- "script-src 'self' 'unsafe-inline' https://openvibe.network",
++ "script-src 'self' 'unsafe-inline' https://openvibe.network https://static.cloudflareinsights.com",
"style-src 'self' 'unsafe-inline' https://openvibe.network https://fonts.googleapis.com https://cdnjs.cloudflare.com",
"font-src 'self' data: https://fonts.gstatic.com https://cdnjs.cloudflare.com",
"img-src 'self' data: https:",
// The navbar asks the Network for the session, menus and notifications.
-- "connect-src 'self' https://openvibe.network https://openvibe.events",
++ "connect-src 'self' https://openvibe.network https://openvibe.events https://cloudflareinsights.com",
"frame-src 'self' https://openvibe.network",
"frame-ancestors 'none'",
"object-src 'none'",