Merge pull request #1189 from tubone24/csp

csp
tubone24 · Dec 31, 2022 · 6a90960 · 6a90960
2 parents d622092 + fd747eb
commit 6a90960
Show file tree

Hide file tree

Showing 4 changed files with 8 additions and 4 deletions.
diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
@@ -231,6 +231,8 @@ jobs:
           node-version: 16.x
       - name: Install dependencies
         run: yarn install --frozen-lockfile
+      - name: delete headers file
+        run: rm -f static/_headers
       - name: yarn build
         env:
           GATSBY_GITHUB_CLIENT_SECRET: ${{secrets.GATSBY_GITHUB_CLIENT_SECRET}}

diff --git a/.github/workflows/previewDeploy.yml b/.github/workflows/previewDeploy.yml
@@ -527,6 +527,8 @@ jobs:
           node-version: 16.x
       - name: install dependencies
         run: yarn install --frozen-lockfile
+      - name: delete headers file
+        run: rm -f static/_headers
       - name: yarn build
         env:
           GATSBY_GITHUB_CLIENT_SECRET: ${{secrets.GATSBY_GITHUB_CLIENT_SECRET}}

diff --git a/src/html.tsx b/src/html.tsx
@@ -32,10 +32,7 @@ const HTML = ({
     <body {...bodyAttributes}>
       {preBodyComponents}
       <script src="/adstir.js" />
-      <script
-        src="https://js.ad-stir.com/js/adstir.js"
-        nonce="ZsQmvvc24RF0Q3OGhq"
-      />
+      <script src="https://js.ad-stir.com/js/adstir.js" />
       <div
         key="body"
         id="___gatsby"

diff --git a/static/_headers b/static/_headers
@@ -0,0 +1,3 @@
+/*
+  Content-Security-Policy: default-src 'self'; img-src *; media-src *; font-src *; script-src 'self' *.google-analytics.com https://*.twitter.com https://*.instagram.com https://embedr.flickr.com https://embed.redditmedia.com https://*.ad-stir.com https://blog-storybook.netlify.app https://www.youtube.com; frame-ancestors 'self' https://*.google-analytics.com https://*.twitter.com https://www.instagram.com https://embedr.flickr.com https://embed.redditmedia.com https://*.ad-stir.com https://blog-storybook.netlify.app https://www.youtube.com; object-src 'self' https://*.google-analytics.com https://*.twitter.com https://www.instagram.com https://embedr.flickr.com https://embed.redditmedia.com https://*.ad-stir.com https://blog-storybook.netlify.app https://www.youtube.com;
+  X-Content-Type-Options: nosniff;