Remove unsafe-eval CSP directive for scripts

bespinian · Oct 15, 2023 · e4359e0 · e4359e0
1 parent ee89e7d
commit e4359e0
Show file tree

Hide file tree

Showing 5 changed files with 96 additions and 94 deletions.
diff --git a/infrastructure/.terraform.lock.hcl b/infrastructure/.terraform.lock.hcl
diff --git a/infrastructure/terraform.tfstate b/infrastructure/terraform.tfstate
@@ -1,6 +1,6 @@
 {
   "version": 4,
-  "terraform_version": "1.5.7",
+  "terraform_version": "1.6.1",
   "serial": 216,
   "lineage": "2c3e0ed3-a77b-46ac-1ae6-ec00c8c0e1e0",
   "outputs": {},

diff --git a/package-lock.json b/package-lock.json
diff --git a/src/app.html b/src/app.html
@@ -3,7 +3,7 @@
 	<head>
 		<meta charset="utf-8" />
 		<link rel="icon" href="%sveltekit.assets%/favicon.png" />
-		<meta name="viewport" content="width=device-width" />
+		<meta name="viewport" content="width=device-width, initial-scale=1" />
 		%sveltekit.head%
 	</head>
 	<body data-sveltekit-preload-data="hover">

diff --git a/svelte.config.js b/svelte.config.js
@@ -14,12 +14,14 @@ const config = {
 		csp: {
 			directives: {
 				'default-src': ['self'],
-				'script-src': ['unsafe-eval', 'unsafe-inline', 'self'],
+				'script-src': ['unsafe-inline', 'self'],
 				'style-src': ['unsafe-inline', 'self'],
 				'img-src': ['self', 'data:'],
 				'font-src': ['self', 'data:'],
 				'connect-src': ['*'],
 				'object-src': ['none'],
+				'frame-ancestors': ['none'],
+				'base-uri': ['none'],
 				'form-action': ['https://formspree.io']
 			}
 		}