Add Content-Security-Policy header

Closes #100
2026-03-07 18:53:52 +00:00
parent d3e1ecd10b
commit 3812b6c402
1 changed files with 5 additions and 1 deletions
@@ -11,7 +11,11 @@ defmodule MusicLibraryWeb.Router do
    plug :fetch_live_flash
    plug :put_root_layout, html: {MusicLibraryWeb.Layouts, :root}
    plug :protect_from_forgery
-    plug :put_secure_browser_headers
+
+    plug :put_secure_browser_headers, %{
+      "content-security-policy" =>
+        "default-src 'self'; script-src 'self'; style-src 'self' https://rsms.me; font-src 'self' https://rsms.me; img-src 'self' data:; connect-src 'self'; frame-ancestors 'self'; base-uri 'self'"
+    }
  end

  pipeline :api do