openvibers/openvibe.tools Commits

Allow Quest guide reads in page CSP (#305)

OP OpenVibers committed 1 days ago · bff1f4878a · 1 file, +1 −1

* Allow Quest guide reads in page CSP

* Merge remote-tracking branch 'origin/main' into quest-guide-csp-tools-1111

* Merge branch 'main' into quest-guide-csp-tools-1111

Changes

ddiff --git a/apps/gateway/server/index.js b/apps/gateway/server/index.js
iindex 48fef6f..c538686 100644
---- a/apps/gateway/server/index.js
++++ b/apps/gateway/server/index.js
@@@ -157,7 +157,7 @@ app.use(helmet({
              imgSrc: ["'self'", "data:", "blob:", "https://openvibe.network", "https://openvibe.media"],
              // openvibe.events: release notifications (release-watch's EventSource, openvibe-shared 2.13.0).
              // The navbar's Messages count asks Chat (openvibe-shared 4.130.0).
--            connectSrc: ["'self'", "https://openvibe.chat", "https://cloudflareinsights.com", "https://openvibe.network", "https://openvibe.tools", "https://*.openvibe.tools", "https://openvibe.media", "https://openvibe.live", "https://openvibe.games", "https://openvibe.events"],
++            connectSrc: ["'self'", "https://openvibe.chat", "https://cloudflareinsights.com", "https://openvibe.network", "https://openvibe.quest", "https://openvibe.tools", "https://*.openvibe.tools", "https://openvibe.media", "https://openvibe.live", "https://openvibe.games", "https://openvibe.events"],
              frameSrc: ["https://openvibe.network"], // the hidden /sso/check sign-in probe
              scriptSrcAttr: ["'unsafe-inline'"],
          },