Allow UNPKG in CSP

owl-corp · Aug 19, 2024 · ae3a047 · ae3a047
1 parent 8af81a6
commit ae3a047
Showing 1 changed file with 2 additions and 1 deletion.
diff --git a/thallium-backend/src/app.py b/thallium-backend/src/app.py
@@ -42,7 +42,8 @@ async def add_process_time_and_security_headers(
  response.headers["Strict-Transport-Security"] = "max-age=31536000"
  response.headers["X-Content-Type-Options"] = "nosniff"
  response.headers["Content-Security-Policy"] = (
- "default-src 'self'; script-src 'unsafe-inline' https://cdn.jsdelivr.net/;"
+ "default-src 'self';"
+ " script-src 'unsafe-inline' https://cdn.jsdelivr.net/ https://unpkg.com/;"
  " style-src https://cdn.jsdelivr.net/ https://fonts.googleapis.com/;"
  " img-src 'self' data:;"
  )