@@ -48,20 +48,33 @@ export default defineNuxtConfig({
4848 csrf : false , // TODO: Enable CSRF protection when we have state-changing endpoints
4949 headers : {
5050 contentSecurityPolicy : {
51+ 'frame-src' : isDev ? [ "'self'" , 'data:' ] : undefined , // Nuxt DevTools
5152 'img-src' : isDev ? [ "'self'" , 'data:' ] : undefined , // Nuxt DevTools
52- 'style-src-attr' : [
53- "'unsafe-hashes'" ,
54- "'sha256-V1oXad6TSON5lAPSlYyq7P4n6DHYMuK6mVMTl6g4Qnc='" // NuxtLoadingIndicator
55- ] ,
56- 'style-src-elem' : isDev
53+ 'script-src-attr' : isDev
5754 ? [
5855 "'unsafe-hashes'" ,
59- "'sha256-OD9WVNQJEovAiR/DJOt93obaRkfsvRKjjDXmxB2VR+w='" , // Nuxt DevTools
56+ "'sha256-7TqQJF3K4wrZpxSqn+IJ/s3Y705jL5IIk8Ga5HVJD1s='" // NuxtErrorPage
57+ ]
58+ : undefined ,
59+ 'script-src-elem' : isDev ? [ "'self'" , "'unsafe-inline'" ] : undefined ,
60+ 'style-src-attr' : isDev
61+ ? [ "'self'" , "'unsafe-inline'" ]
62+ : [
63+ "'unsafe-hashes'" ,
64+ "'sha256-V1oXad6TSON5lAPSlYyq7P4n6DHYMuK6mVMTl6g4Qnc='" // NuxtLoadingIndicator
65+ ] ,
66+ 'style-src-elem' : isDev
67+ ? [
68+ "'self'" ,
69+ "'unsafe-inline'"
70+ // "'unsafe-hashes'",
71+ // "'sha256-OD9WVNQJEovAiR/DJOt93obaRkfsvRKjjDXmxB2VR+w='", // Nuxt DevTools
6072 // TODO: Remove when NuxtWelcome is removed
61- "'sha256-xfTtFXgyQRFFrgZl3DoFKJBt5UsgD7QZ2l1JoWk3xCk='" , // NuxtWelcome
62- "'sha256-zyQlNcK/TQ7fWXm/87qoWxHXLGBjDfqDj7AkcCt2weM='" // NuxtWelcome
73+ // "'sha256-xfTtFXgyQRFFrgZl3DoFKJBt5UsgD7QZ2l1JoWk3xCk='", // NuxtWelcome
74+ // "'sha256-zyQlNcK/TQ7fWXm/87qoWxHXLGBjDfqDj7AkcCt2weM='", // NuxtWelcome
6375 ]
64- : undefined
76+ : undefined ,
77+ 'worker-src' : isDev ? [ "'self'" , 'blob:' ] : undefined // Nuxt DevTools
6578 }
6679 } ,
6780 rateLimiter : { headers : true } ,
0 commit comments