fix(csp): fonts and script

SocialGouv · Sep 2, 2021 · dd61a28 · dd61a28
1 parent 6701600
commit dd61a28
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/.socialgouv/config.json b/.socialgouv/config.json
@@ -6,7 +6,7 @@
   "registry": "ghcr",
   "ingress": {
     "annotations": {
-      "nginx.ingress.kubernetes.io/configuration-snippet": "more_set_headers \"Content-Security-Policy: default-src 'none'; connect-src 'self' https://*.gouv.fr; font-src 'self'; media-src 'self' https://*.gouv.fr; img-src 'self' https://*.gouv.fr https://a.tile.openstreetmap.org https://b.tile.openstreetmap.org https://c.tile.openstreetmap.org; prefetch-src 'self' https://*.gouv.fr; script-src 'self' https://*.gouv.fr; frame-src 'self' https://*.gouv.fr; style-src 'self' 'unsafe-inline'\";\nmore_set_headers \"X-Frame-Options: deny\";\nmore_set_headers \"X-XSS-Protection: 1; mode=block\";\nmore_set_headers \"X-Content-Type-Options: nosniff\";"
+      "nginx.ingress.kubernetes.io/configuration-snippet": "more_set_headers \"Content-Security-Policy: default-src 'self'; connect-src 'self' https://*.gouv.fr; font-src 'self' https://fonts.gstatic.com/; media-src 'self' https://*.gouv.fr; img-src 'self' https://*.gouv.fr https://a.tile.openstreetmap.org https://b.tile.openstreetmap.org https://c.tile.openstreetmap.org; prefetch-src 'self' https://*.gouv.fr; script-src 'self' https://*.gouv.fr 'unsafe-inline'; frame-src 'self' https://*.gouv.fr; style-src 'self' 'unsafe-inline'\";\nmore_set_headers \"X-Frame-Options: deny\";\nmore_set_headers \"X-XSS-Protection: 1; mode=block\";\nmore_set_headers \"X-Content-Type-Options: nosniff\";"
     }
   }
 }