Add swagger to CSP

cisagov · Dec 5, 2024 · c9849ee · c9849ee
1 parent 5f4cdd8
commit c9849ee
Showing 1 changed file with 9 additions and 1 deletion.
diff --git a/backend/src/xfd_django/xfd_django/asgi.py b/backend/src/xfd_django/xfd_django/asgi.py
@@ -34,6 +34,7 @@
         "'self'",
         os.getenv("COGNITO_URL"),
         os.getenv("BACKEND_DOMAIN"),
+        "https://cdn.jsdelivr.net/npm/[email protected]/swagger-ui-bundle.js"
     ],
     "frame-src": ["'self'", "https://www.dhs.gov/ntas/"],
     "img-src": [
@@ -42,6 +43,7 @@
         os.getenv("FRONTEND_DOMAIN"),
         "https://www.ssa.gov",
         "https://www.dhs.gov",
+        "https://fastapi.tiangolo.com/img/favicon.png"
     ],
     "object-src": ["'none'"],
     "script-src": [
@@ -50,9 +52,15 @@
         "https://ajax.googleapis.com/ajax/libs/jquery/3.7.1/jquery.min.js",
         "https://www.ssa.gov/accessibility/andi/fandi.js",
         "https://www.ssa.gov/accessibility/andi/andi.js",
+        "https://cdn.jsdelivr.net/npm/[email protected]/swagger-ui-bundle.js",
+        "'sha256-QOOQu4W1oxGqd2nbXbxiA1Di6OHQOLQD+o+G9oWL8YY='",
         "https://www.dhs.gov",
     ],
-    "style-src": ["'self'", "'unsafe-inline'"],
+    "style-src": [
+        "'self'",
+        "'unsafe-inline'",
+        "https://cdn.jsdelivr.net/npm/[email protected]/swagger-ui.css"
+        ],
     "frame-ancestors": ["'none'"],
 }