mirror of https://github.com/status-im/codimd.git
Don't add nonce to CSP if unsafe-inline is on
Browsers ignore unsafe-inline if a nonce is sent
This commit is contained in:
parent
91101c856c
commit
d51da8c12c
4
app.js
4
app.js
|
@ -171,7 +171,9 @@ if (config.csp.enable) {
|
|||
)
|
||||
}
|
||||
}
|
||||
directives.scriptSrc.push(getCspNonce)
|
||||
if (directives.scriptSrc.indexOf('\'unsafe-inline\'') === -1) {
|
||||
directives.scriptSrc.push(getCspNonce)
|
||||
}
|
||||
directives.connectSrc.push(getCspWebSocketUrl)
|
||||
if (config.csp.upgradeInsecureRequests === 'auto') {
|
||||
directives.upgradeInsecureRequests = config.usessl === 'true'
|
||||
|
|
Loading…
Reference in New Issue