Merge pull request #13501 from brave/fix/13499

Allow 'self' CSP connect-src by default
brave · Mar 19, 2018 · 33c3e84 · 33c3e84
1 parent 27f76a7
commit 33c3e84
Showing 1 changed file with 3 additions and 3 deletions.
diff --git a/app/extensions.js b/app/extensions.js
@@ -198,16 +198,16 @@ let generateBraveManifest = () => {
     'style-src': '\'self\' \'unsafe-inline\'',
     'font-src': '\'self\' data:',
     'img-src': '* data: file://*',
-    'connect-src': 'https://www.youtube.com',
+    'connect-src': '\'self\' https://www.youtube.com',
     'frame-src': '\'self\' https://brave.com'
   }
 
   if (process.env.NODE_ENV === 'development') {
     // allow access to webpack dev server resources
     let devServer = 'localhost:' + process.env.npm_package_config_port
     cspDirectives['default-src'] = '\'self\' http://' + devServer
-    cspDirectives['connect-src'] = cspDirectives['connect-src'] + [
-      ' \'self\'',
+    cspDirectives['connect-src'] = [
+      cspDirectives['connect-src'],
       'http://' + devServer,
       'ws://' + devServer
     ].join(' ')