fix(csp): do it ourself

2026-05-30 13:50:32 -05:00
1 changed files with 2 additions and 0 deletions
@@ -5,6 +5,8 @@ export default function corsMiddleware (req, res, next) {
    'Access-Control-Allow-Headers': 'Authorization,Content-Type,Accept,Content-Encoding,X-Requested-With,x-api-user,x-api-key,x-client',
    // Expose rate limit headers to CORS requests
    'Access-Control-Expose-Headers': 'X-RateLimit-Limit,X-RateLimit-Remaining,X-RateLimit-Reset,Retry-After',
+    // Content-Security-Policy based on Helmet defaults
+    'Content-Security-Policy': "default-src 'self' habitica.com *.habitica.com *.amazon.com *.amazonaws.com *.amplitude.com *.loggly.com *.payments-amazon.com *.stripe.com *.stripe.network; base-uri 'self'; font-src 'self' https: data:; form-action 'self'; frame-ancestors 'self'; img-src * data:; object-src 'none'; script-src-attr 'none'; style-src 'self' https: 'unsafe-inline'",
  });
  if (req.method === 'OPTIONS') return res.sendStatus(200);
  return next();