From 6d1054d74422a2761a961cc28ad3ba2613d534e2 Mon Sep 17 00:00:00 2001 From: meissadia Date: Mon, 27 Jan 2020 12:56:54 -0500 Subject: [PATCH] Add github to image csp --- nginx/nginx.conf | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/nginx/nginx.conf b/nginx/nginx.conf index 3c04f1e53..99b59e6d0 100644 --- a/nginx/nginx.conf +++ b/nginx/nginx.conf @@ -23,7 +23,7 @@ http { add_header Strict-Transport-Security 'max-age=31536000; includeSubDomains; preload'; # CSP - add_header Content-Security-Policy "default-src 'self' blob:; script-src 'self' 'unsafe-inline' blob: data: https://tagmanager.google.com https://www.googletagmanager.com https://www.google-analytics.com; img-src 'self' blob: data: https://www.google-analytics.com; style-src 'self' 'unsafe-inline'; font-src 'self' data:; object-src 'none'; frame-src 'self' https://www.youtube.com/; connect-src 'self' https://raw.githubusercontent.com https://ffiec-api.cfpb.gov https://ffiec.cfpb.gov https://*.mapbox.com https://www.google-analytics.com https://s3.amazonaws.com;"; + add_header Content-Security-Policy "default-src 'self' blob:; script-src 'self' 'unsafe-inline' blob: data: https://tagmanager.google.com https://www.googletagmanager.com https://www.google-analytics.com; img-src 'self' blob: data: https://www.google-analytics.com https://raw.githubusercontent.com; style-src 'self' 'unsafe-inline'; font-src 'self' data:; object-src 'none'; frame-src 'self' https://www.youtube.com/; connect-src 'self' https://raw.githubusercontent.com https://ffiec-api.cfpb.gov https://ffiec.cfpb.gov https://*.mapbox.com https://www.google-analytics.com https://s3.amazonaws.com;"; # Prevent buffer tampering client_body_buffer_size 16k;