cloud/music_library
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Split strings for readability

Browse Source
This commit is contained in:
Claudio Ortolina
2026-03-07 23:44:00 +00:00
parent 05354b9f78
commit 1bfe501b3d
1 changed files with 16 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
lib/music_library_web/router.ex
+16 -2
View File
@@ -8,7 +8,14 @@ defmodule MusicLibraryWeb.Router do
# Content Security Policy: restricts resource loading to same-origin by default,
# allows inline styles and Inter font from rsms.me, album art from Last.fm CDN,
# and prevents framing by external sites.
@csp_policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline' https://rsms.me; font-src 'self' https://rsms.me; img-src 'self' data: https://lastfm.freetls.fastly.net; connect-src 'self'; frame-ancestors 'self'; base-uri 'self'"
@csp_policy "default-src 'self'" <>
"; script-src 'self'" <>
"; style-src 'self' 'unsafe-inline' https://rsms.me" <>
"; font-src 'self' https://rsms.me" <>
"; img-src 'self' data: https://lastfm.freetls.fastly.net" <>
"; connect-src 'self'" <>
"; frame-ancestors 'self'" <>
"; base-uri 'self'"
pipeline :browser do
plug :accepts, ["html"]
@@ -169,7 +176,14 @@ defmodule MusicLibraryWeb.Router do
nonce = conn.assigns[:script_nonce]
csp =
"default-src 'self'; script-src 'self' 'nonce-#{nonce}'; style-src 'self' 'unsafe-inline' 'nonce-#{nonce}' https://rsms.me; font-src 'self' data: https://rsms.me; img-src 'self' data: 'nonce-#{nonce}' https://lastfm.freetls.fastly.net; connect-src 'self'; frame-ancestors 'self'; base-uri 'self'"
"default-src 'self'" <>
"; script-src 'self' 'nonce-#{nonce}'" <>
"; style-src 'self' 'unsafe-inline' 'nonce-#{nonce}' https://rsms.me" <>
"; font-src 'self' data: https://rsms.me" <>
"; img-src 'self' data: 'nonce-#{nonce}' https://lastfm.freetls.fastly.net" <>
"; connect-src 'self'" <>
"; frame-ancestors 'self'" <>
"; base-uri 'self'"
delete_resp_header(conn, "content-security-policy")
|> put_resp_header("content-security-policy", csp)