diff --git a/README.md b/README.md index c1aa053..8caa85c 100644 --- a/README.md +++ b/README.md @@ -119,7 +119,7 @@ HELMET_COEP= # # Example config: # { -# "img-src": ["'self'", "domain.com"], +# "img-src": ["'self'", "data:"], # "script-src": ["'self'", "'unsafe-inline'"], # "script-src-attr": ["'self'", "'unsafe-inline'"] # } diff --git a/api/csp.config.example.json b/api/csp.config.example.json index 8ca57a5..82599fc 100644 --- a/api/csp.config.example.json +++ b/api/csp.config.example.json @@ -1,5 +1,5 @@ { - "img-src": ["'self'", "domen.com"], + "img-src": ["'self'", "data:"], "script-src": ["'self'", "'unsafe-inline'"], "script-src-attr": ["'self'", "'unsafe-inline'"] } \ No newline at end of file diff --git a/api/src/utils/parseHelmetConfig.ts b/api/src/utils/parseHelmetConfig.ts index 7310431..4f52b37 100644 --- a/api/src/utils/parseHelmetConfig.ts +++ b/api/src/utils/parseHelmetConfig.ts @@ -5,7 +5,9 @@ export const getEnvCSPDirectives = ( HELMET_CSP_CONFIG_PATH: string | undefined ) => { let cspConfigJson = { - 'script-src': ["'self'", "'unsafe-inline'"] + 'img-src': ["'self'", 'data:'], + 'script-src': ["'self'", "'unsafe-inline'"], + 'script-src-attr': ["'self'", "'unsafe-inline'"] } if (