From 59616e58b596a5d4fe6f8c478e5948186fa785b5 Mon Sep 17 00:00:00 2001 From: Claudio Ortolina Date: Sun, 8 Mar 2026 19:44:41 +0000 Subject: [PATCH] Allow LiveDebugger origins in dev --- lib/music_library_web/router.ex | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/lib/music_library_web/router.ex b/lib/music_library_web/router.ex index f20a9589..00cd1b58 100644 --- a/lib/music_library_web/router.ex +++ b/lib/music_library_web/router.ex @@ -8,12 +8,15 @@ defmodule MusicLibraryWeb.Router do # Content Security Policy: restricts resource loading to same-origin by default, # allows inline styles and Inter font from rsms.me, album art from Last.fm CDN, # and prevents framing by external sites. + # In dev, allows LiveDebugger and Phoenix dev assets from 127.0.0.1:4007. + @dev_origins if(Mix.env() == :dev, do: " http://127.0.0.1:* ws://127.0.0.1:*", else: "") + @csp_policy "default-src 'self'" <> - "; script-src 'self'" <> - "; style-src 'self' 'unsafe-inline' https://rsms.me" <> + "; script-src 'self'#{@dev_origins}" <> + "; style-src 'self' 'unsafe-inline' https://rsms.me#{@dev_origins}" <> "; font-src 'self' https://rsms.me" <> "; img-src 'self' data: https://lastfm.freetls.fastly.net" <> - "; connect-src 'self'" <> + "; connect-src 'self'#{@dev_origins}" <> "; frame-ancestors 'self'" <> "; base-uri 'self'"