diff options
| author | Adam Mathes <adam@adammathes.com> | 2026-02-14 10:14:09 -0800 |
|---|---|---|
| committer | Adam Mathes <adam@adammathes.com> | 2026-02-14 10:14:09 -0800 |
| commit | 00512c639841dac9ca8d1cff5c2532ce7584eb15 (patch) | |
| tree | 6e9950385b3e4fbd63b044fb830d53541ae61cf0 /web/web.go | |
| parent | 9d3b2a90316a1a5f735845f61abbd8a875529060 (diff) | |
| download | neko-00512c639841dac9ca8d1cff5c2532ce7584eb15.tar.gz neko-00512c639841dac9ca8d1cff5c2532ce7584eb15.tar.bz2 neko-00512c639841dac9ca8d1cff5c2532ce7584eb15.zip | |
fix: relax CSP to allow unsafe-eval for legacy UI
Diffstat (limited to 'web/web.go')
| -rw-r--r-- | web/web.go | 2 |
1 files changed, 1 insertions, 1 deletions
@@ -401,7 +401,7 @@ func SecurityHeadersMiddleware(next http.Handler) http.Handler { // style-src 'self' 'unsafe-inline' (for React/styled-components if used) // img-src 'self' data: * (RSS images can be from anywhere) // connect-src 'self' (API calls) - w.Header().Set("Content-Security-Policy", "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: *; connect-src 'self'; frame-ancestors 'none';") + w.Header().Set("Content-Security-Policy", "default-src 'self'; script-src 'self' 'unsafe-eval'; style-src 'self' 'unsafe-inline'; img-src 'self' data: *; connect-src 'self'; frame-ancestors 'none';") next.ServeHTTP(w, r) }) } |