Set a Content Security Policy

oslokommune · Oct 18, 2023 · 9df7a38 · 9df7a38
1 parent af105c0
commit 9df7a38
Show file tree

Hide file tree

Showing 2 changed files with 12 additions and 0 deletions.
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -11,6 +11,7 @@ All notable changes to this project will be documented in this file. The format
 
 ### Security
 
+- A Content Security Policy is now set.
 - Updated dependencies.
 
 ## [3.10.0] 2023-10-10

diff --git a/firebase.json b/firebase.json
@@ -11,6 +11,17 @@
         "source": "**",
         "destination": "/index.html"
       }
+    ],
+    "headers": [
+      {
+        "source":"**",
+        "headers": [
+          {
+            "key": "Content-Security-Policy",
+            "value": "script-src 'self' 'unsafe-eval' 'unsafe-inline' apis.google.com"
+          }
+        ]
+      }
     ]
   },
   "storage": {