1 import * as helmet from 'helmet'
2 import { CONFIG } from '../initializers/constants'
4 const baseDirectives = Object.assign({},
6 defaultSrc: ["'none'"], // by default, not specifying default-src = '*'
7 connectSrc: ['*', 'data:'],
8 mediaSrc: ["'self'", 'https:', 'blob:'],
9 fontSrc: ["'self'", 'data:'],
10 imgSrc: ["'self'", 'data:'],
11 scriptSrc: ["'self' 'unsafe-inline'"],
12 styleSrc: ["'self' 'unsafe-inline'"],
13 // objectSrc: ["'none'"], // only define to allow plugins, else let defaultSrc 'none' block it
14 formAction: ["'self'"],
15 frameAncestors: ["'none'"],
17 pluginTypes: ["'none'"],
18 manifestSrc: ["'self'"],
19 frameSrc: ["'self'"], // instead of deprecated child-src / self because of test-embed
20 workerSrc: ["'self'"], // instead of deprecated child-src
21 upgradeInsecureRequests: true
23 (CONFIG.SERVICES['CSP-LOGGER'] != null) ? { reportUri: CONFIG.SERVICES['CSP-LOGGER'] } : {}
26 const baseCSP = helmet.contentSecurityPolicy({
27 directives: baseDirectives,
32 const embedCSP = helmet.contentSecurityPolicy({
33 directives: Object.assign(baseDirectives, {
36 browserSniff: false, // assumes a modern browser, but allows CDN in front
40 // ---------------------------------------------------------------------------