From: Dessalines <tyhou13@gmx.com>
Date: Mon, 23 Nov 2020 17:41:57 +0000 (-0600)
Subject: Adding a content security policy. Fixes #20
X-Git-Url: http://these/git/%7B%60https:/%7B%24%7B%60data:application/static/gitweb.js?a=commitdiff_plain;h=235a6f2abe9370b346e405f26ec4c23c3741c056;p=lemmy-ui.git

Adding a content security policy. Fixes #20
---

diff --git a/src/server/index.tsx b/src/server/index.tsx
index 5222a86..35d02c1 100644
--- a/src/server/index.tsx
+++ b/src/server/index.tsx
@@ -101,6 +101,9 @@ server.get('/*', async (req, res) => {
            <meta charset="utf-8">
            <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no">
 
+           <!-- Content Security Policy -->
+           <meta http-equiv="Content-Security-Policy" content="default-src 'none'; connect-src 'self'; frame-src *; img-src *; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'">
+
            <!-- Web app manifest -->
            <link rel="manifest" href="/static/assets/manifest.webmanifest">