fix: blocked:csp exception for media content at DO

Vizzuality · Dec 5, 2023 · 0357f5b · 0357f5b
1 parent e3ad19f
commit 0357f5b
Show file tree

Hide file tree

Showing 3 changed files with 7 additions and 3 deletions.
diff --git a/cms/config/middlewares.ts b/cms/config/middlewares.ts
@@ -1,4 +1,4 @@
-export default [
+export default ({ env }) => [
   'strapi::errors',
   {
     name: 'strapi::security',
@@ -8,8 +8,8 @@ export default [
         directives: {
           'connect-src': ["'self'", 'https:'],
           'script-src': ["'self'", "'unsafe-inline'", 'cdn.jsdelivr.net', 'api.mapbox.com'],
-          'img-src': ["'self'", 'data:', 'blob:'],
-          'media-src': ["'self'", 'data:', 'blob:'],
+          'img-src': ["'self'", 'data:', 'blob:', `${env('DO_SPACE_FULL_PATH')}`],
+          'media-src': ["'self'", 'data:', 'blob:', `${env('DO_SPACE_FULL_PATH')}`],
           'worker-src': ['blob:'],
           upgradeInsecureRequests: null,
         },

diff --git a/infrastructure/base/main.tf b/infrastructure/base/main.tf
@@ -43,10 +43,13 @@ locals {
     CMS_URL                          = "${module.staging.app_url}/cms/"
     STRAPI_ADMIN_API_BASE_URL        = "${module.staging.app_url}/cms/api"
     STRAPI_ADMIN_MAPBOX_ACCESS_TOKEN = var.mapbox_api_token
+
+    # DigitalOcean Spaces to store media content
     DO_SPACE_ACCESS_KEY              = var.do_spaces_client_id
     DO_SPACE_SECRET_KEY              = var.do_spaces_secret_key
     DO_SPACE_ENDPOINT                = "https://${var.do_region}.digitaloceanspaces.com"
     DO_SPACE_BUCKET                  = "${var.project_name}-staging-cms"
+    DO_SPACE_FULL_PATH               = "https://${var.project_name}-staging-cms.${var.do_region}.digitaloceanspaces.com"
 
     # Database
     DATABASE_CLIENT                  = "postgres"

diff --git a/infrastructure/base/modules/env/main.tf b/infrastructure/base/modules/env/main.tf
@@ -55,6 +55,7 @@ resource "digitalocean_spaces_bucket_cors_configuration" "space_cms_cors" {
     allowed_headers = ["*"]
     allowed_methods = ["GET", "HEAD", "PUT", "POST", "DELETE"]
     allowed_origins = ["*"]
+    expose_headers  = ["ETag", "Access-Control-Allow-Origin"]
     max_age_seconds = 3000
   }
 }