X-Git-Url: https://git.immae.eu/?a=blobdiff_plain;f=server%2Fmiddlewares%2Fcsp.ts;h=e2a75a17ebae7427e70bf6da5ca2e9782bfdd48b;hb=4cf800a350972a078c074da6b31da2b98ab4b007;hp=0ee44bf4782a1c446d82584e37592420e00de2cf;hpb=5d666c0eb25a1b665caa46c4210c1dc2a6b5b333;p=github%2FChocobozzz%2FPeerTube.git diff --git a/server/middlewares/csp.ts b/server/middlewares/csp.ts index 0ee44bf47..e2a75a17e 100644 --- a/server/middlewares/csp.ts +++ b/server/middlewares/csp.ts @@ -1,4 +1,4 @@ -import * as helmet from 'helmet' +import { contentSecurityPolicy } from 'helmet' import { CONFIG } from '../initializers/config' const baseDirectives = Object.assign({}, @@ -22,12 +22,12 @@ const baseDirectives = Object.assign({}, CONFIG.WEBSERVER.SCHEME === 'https' ? { upgradeInsecureRequests: [] } : {} ) -const baseCSP = helmet.contentSecurityPolicy({ +const baseCSP = contentSecurityPolicy({ directives: baseDirectives, reportOnly: CONFIG.CSP.REPORT_ONLY }) -const embedCSP = helmet.contentSecurityPolicy({ +const embedCSP = contentSecurityPolicy({ directives: Object.assign({}, baseDirectives, { frameAncestors: [ '*' ] }), reportOnly: CONFIG.CSP.REPORT_ONLY })