openvibers/openvibe.tours Commits

CSP: connect-src allows openvibe.events (the bell's realtime feed) (#53)

OP OpenVibers committed 11 days ago · 79733cf0fe · 1 file, +1 −1

notification-live.js (openvibe-shared) opens https://openvibe.events/realtime/stream for the bell's live
updates; this site's connect-src left it out, so every page logged a CSP refusal and the bell missed
live notices (found by a sweep of every site's home, 11-02).

Changes

ddiff --git a/server/app.js b/server/app.js
iindex 4f8c8fa..5a36aa4 100644
---- a/server/app.js
++++ b/server/app.js
@@@ -87,7 +87,7 @@ async function createApp(opts = {}) {
                  styleSrc: ["'self'", "'unsafe-inline'", 'https://openvibe.network', 'https://fonts.googleapis.com', 'https://unpkg.com'],
                  fontSrc: ["'self'", 'data:', 'https://fonts.gstatic.com'],
                  imgSrc: ["'self'", 'data:', 'https://openvibe.network', 'https://openvibe.live', 'https://openvibe.rent', 'https://upload.wikimedia.org', 'https://thumb.wikimedia.org', 'https://openvibe.media', 'https://commons.wikimedia.org', 'https://*.tile.openstreetmap.org', 'https://unpkg.com'],
--                connectSrc: ["'self'", 'https://openvibe.network', 'https://cloudflareinsights.com', 'https://openvibe.live', 'https://openvibe.rent', 'https://*.tile.openstreetmap.org', 'https://unpkg.com'],
++                connectSrc: ["'self'", 'https://openvibe.network', 'https://cloudflareinsights.com', 'https://openvibe.live', 'https://openvibe.rent', 'https://*.tile.openstreetmap.org', 'https://unpkg.com', 'https://openvibe.events'],
                  workerSrc: ["'self'", 'blob:'],
                  frameSrc: ["'self'", 'https://openvibe.network'],
                  frameAncestors: ["'none'"],