Remove unsafe-eval CSP directive for scripts

bespinian · Oct 6, 2023 · 1c8494b · 1c8494b
1 parent ee89e7d
commit 1c8494b
Show file tree

Hide file tree

Showing 2 changed files with 9 additions and 7 deletions.
diff --git a/package-lock.json b/package-lock.json
diff --git a/svelte.config.js b/svelte.config.js
@@ -14,12 +14,14 @@ const config = {
 		csp: {
 			directives: {
 				'default-src': ['self'],
-				'script-src': ['unsafe-eval', 'unsafe-inline', 'self'],
+				'script-src': ['unsafe-inline', 'self'],
 				'style-src': ['unsafe-inline', 'self'],
 				'img-src': ['self', 'data:'],
 				'font-src': ['self', 'data:'],
 				'connect-src': ['*'],
 				'object-src': ['none'],
+				'frame-ancestors': ['none'],
+				'base-uri': ['none'],
 				'form-action': ['https://formspree.io']
 			}
 		}