openvibers/openvibe.run Commits
openvibe.run's CSP allows Cloudflare Web Analytics' beacon (it was refused in every visitor's console) (#68)
Changes
@@@ -28,12 +28,12 @@ const DESCRIPTION = 'Run jobs on your own machine or on a node that can: one APIconst HOME_CSP = ["default-src 'self'",// The Frame's theme-loader, navbar and footer are served from /shared; the inline boot is the shell's.-- "script-src 'self' 'unsafe-inline' https://openvibe.network",++ "script-src 'self' 'unsafe-inline' https://openvibe.network https://static.cloudflareinsights.com","style-src 'self' 'unsafe-inline' https://openvibe.network https://fonts.googleapis.com https://cdnjs.cloudflare.com","font-src 'self' data: https://fonts.gstatic.com https://cdnjs.cloudflare.com","img-src 'self' data: https:",// The navbar asks the Network for the session, menus and notifications.-- "connect-src 'self' https://openvibe.network https://openvibe.events",++ "connect-src 'self' https://openvibe.network https://openvibe.events https://cloudflareinsights.com","frame-src 'self' https://openvibe.network","frame-ancestors 'none'","object-src 'none'",
@@ -28,12 +28,12 @@ const DESCRIPTION = 'Run jobs on your own machine or on a node that can: one API
@@ -28,12 +28,12 @@ const DESCRIPTION = 'Run jobs on your own machine or on a node that can: one API
const HOME_CSP = [
const HOME_CSP = [
"default-src 'self'",
"default-src 'self'",
// The Frame's theme-loader, navbar and footer are served from /shared; the inline boot is the shell's.
// The Frame's theme-loader, navbar and footer are served from /shared; the inline boot is the shell's.
- "script-src 'self' 'unsafe-inline' https://openvibe.network",
+ "script-src 'self' 'unsafe-inline' https://openvibe.network https://static.cloudflareinsights.com",
"style-src 'self' 'unsafe-inline' https://openvibe.network https://fonts.googleapis.com https://cdnjs.cloudflare.com",
"style-src 'self' 'unsafe-inline' https://openvibe.network https://fonts.googleapis.com https://cdnjs.cloudflare.com",
"font-src 'self' data: https://fonts.gstatic.com https://cdnjs.cloudflare.com",
"font-src 'self' data: https://fonts.gstatic.com https://cdnjs.cloudflare.com",
"img-src 'self' data: https:",
"img-src 'self' data: https:",
// The navbar asks the Network for the session, menus and notifications.
// The navbar asks the Network for the session, menus and notifications.
- "connect-src 'self' https://openvibe.network https://openvibe.events",
+ "connect-src 'self' https://openvibe.network https://openvibe.events https://cloudflareinsights.com",
"frame-src 'self' https://openvibe.network",
"frame-src 'self' https://openvibe.network",
"frame-ancestors 'none'",
"frame-ancestors 'none'",
"object-src 'none'",
"object-src 'none'",