From 80e4b8617a3e8794c6195c2d8b4723cd3f09ed41 Mon Sep 17 00:00:00 2001
From: Kalista Payne <kalista@habitica.com>
Date: Tue, 7 Apr 2026 16:00:36 -0500
Subject: [PATCH] fix(csp): habitica.com isn't *.habitica.com

---
 website/server/middlewares/index.js | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/website/server/middlewares/index.js b/website/server/middlewares/index.js
index 095232ec9e..ff498829d1 100644
--- a/website/server/middlewares/index.js
+++ b/website/server/middlewares/index.js
@@ -71,6 +71,7 @@ export default function attachMiddlewares (app, server) {
     contentSecurityPolicy: {
       directives: {
         defaultSrc: [
+          'habitica.com',
           '*.habitica.com',
           '*.amazon.com',
           '*.amazonaws.com',
@@ -85,6 +86,7 @@ export default function attachMiddlewares (app, server) {
           'data:',
         ],
         scriptSrc: [
+          'habitica.com',
           '*.habitica.com',
           '*.amazon.com',
           '*.amazonaws.com',