cloud/music_library
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Dry up CSP policies

Browse Source
This commit is contained in:
Claudio Ortolina
2026-03-08 19:56:05 +00:00
parent 77c45bddc6
commit f9845e8b7c
1 changed files with 6 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
lib/music_library_web/router.ex
+6 -5
View File
@@ -6,16 +6,17 @@ defmodule MusicLibraryWeb.Router do
import Oban.Web.Router
# Content Security Policy: restricts resource loading to same-origin by default,
# allows inline styles and Inter font from rsms.me, album art from Last.fm CDN,
# and prevents framing by external sites.
# In dev, allows LiveDebugger and Phoenix dev assets from 127.0.0.1:4007.
# allows inline styles/scripts and Inter font from rsms.me, album art from
# Last.fm CDN, Brave Search, and Cover Art Archive, and prevents framing.
# In dev, allows LiveDebugger and Phoenix dev assets from 127.0.0.1.
@dev_origins if(Mix.env() == :dev, do: " http://127.0.0.1:* ws://127.0.0.1:*", else: "")
@img_origins "https://lastfm.freetls.fastly.net https://imgs.search.brave.com https://coverartarchive.org https://archive.org https://*.archive.org"
@csp_policy "default-src 'self'" <>
"; script-src 'self' 'unsafe-inline'#{@dev_origins}" <>
"; style-src 'self' 'unsafe-inline' https://rsms.me#{@dev_origins}" <>
"; font-src 'self' https://rsms.me" <>
"; img-src 'self' data: https://lastfm.freetls.fastly.net https://imgs.search.brave.com https://coverartarchive.org https://archive.org https://*.archive.org" <>
"; img-src 'self' data: #{@img_origins}" <>
"; connect-src 'self'#{@dev_origins}" <>
"; frame-ancestors 'self'" <>
"; base-uri 'self'"
@@ -183,7 +184,7 @@ defmodule MusicLibraryWeb.Router do
"; script-src 'self' 'nonce-#{nonce}'" <>
"; style-src 'self' 'unsafe-inline' 'nonce-#{nonce}' https://rsms.me" <>
"; font-src 'self' data: https://rsms.me" <>
"; img-src 'self' data: 'nonce-#{nonce}' https://lastfm.freetls.fastly.net https://imgs.search.brave.com https://coverartarchive.org https://archive.org https://*.archive.org" <>
"; img-src 'self' data: 'nonce-#{nonce}' #{@img_origins}" <>
"; connect-src 'self'" <>
"; frame-ancestors 'self'" <>
"; base-uri 'self'"