From 1bfe501b3d83115e34f98b00b0910f71a4094a20 Mon Sep 17 00:00:00 2001 From: Claudio Ortolina Date: Sat, 7 Mar 2026 23:44:00 +0000 Subject: [PATCH] Split strings for readability --- lib/music_library_web/router.ex | 18 ++++++++++++++++-- 1 file changed, 16 insertions(+), 2 deletions(-) diff --git a/lib/music_library_web/router.ex b/lib/music_library_web/router.ex index 28cbed5c..f20a9589 100644 --- a/lib/music_library_web/router.ex +++ b/lib/music_library_web/router.ex @@ -8,7 +8,14 @@ defmodule MusicLibraryWeb.Router do # Content Security Policy: restricts resource loading to same-origin by default, # allows inline styles and Inter font from rsms.me, album art from Last.fm CDN, # and prevents framing by external sites. - @csp_policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline' https://rsms.me; font-src 'self' https://rsms.me; img-src 'self' data: https://lastfm.freetls.fastly.net; connect-src 'self'; frame-ancestors 'self'; base-uri 'self'" + @csp_policy "default-src 'self'" <> + "; script-src 'self'" <> + "; style-src 'self' 'unsafe-inline' https://rsms.me" <> + "; font-src 'self' https://rsms.me" <> + "; img-src 'self' data: https://lastfm.freetls.fastly.net" <> + "; connect-src 'self'" <> + "; frame-ancestors 'self'" <> + "; base-uri 'self'" pipeline :browser do plug :accepts, ["html"] @@ -169,7 +176,14 @@ defmodule MusicLibraryWeb.Router do nonce = conn.assigns[:script_nonce] csp = - "default-src 'self'; script-src 'self' 'nonce-#{nonce}'; style-src 'self' 'unsafe-inline' 'nonce-#{nonce}' https://rsms.me; font-src 'self' data: https://rsms.me; img-src 'self' data: 'nonce-#{nonce}' https://lastfm.freetls.fastly.net; connect-src 'self'; frame-ancestors 'self'; base-uri 'self'" + "default-src 'self'" <> + "; script-src 'self' 'nonce-#{nonce}'" <> + "; style-src 'self' 'unsafe-inline' 'nonce-#{nonce}' https://rsms.me" <> + "; font-src 'self' data: https://rsms.me" <> + "; img-src 'self' data: 'nonce-#{nonce}' https://lastfm.freetls.fastly.net" <> + "; connect-src 'self'" <> + "; frame-ancestors 'self'" <> + "; base-uri 'self'" delete_resp_header(conn, "content-security-policy") |> put_resp_header("content-security-policy", csp)