jake/jarv.is
1
Fork 0
mirror of https://github.com/jakejarvis/jarv.is.git synced 2026-08-25 16:05:39 -04:00
Code Issues Activity

improved CSP reporting middleware

Browse Source
This commit is contained in:
jake
2021-11-08 07:09:58 -05:00
parent 6ff4bc52e5
commit 4c56707026
4 changed files with 116 additions and 20 deletions
Download Patch File Download Diff File Expand all files Collapse all files
vercel.json
+1 -6
View File
@@ -12,11 +12,6 @@
"source": "/apple-touch-icon-precomposed.png",
"destination": "/assets/images/apple-touch-icon.png"
},
{
"source": "/api/csp_wizard/",
"destination": "https://jarvis.report-uri.com/r/d/csp/enforce"
},
{ "source": "/api/report/", "destination": "https://jarvis.report-uri.com/a/d/g" },
{ "source": "/api/mention/", "destination": "https://webmention.io/jarv.is/webmention" },
{ "source": "/api/ping/", "destination": "https://webmention.io/jarv.is/xmlrpc" }
],
@@ -88,7 +83,7 @@
},
{
"key": "Content-Security-Policy",
"value": "default-src 'self'; base-uri 'none'; connect-src 'self' api.github.com hcaptcha.com *.hcaptcha.com platform.twitter.com; font-src 'self'; form-action 'self'; frame-ancestors 'self'; frame-src 'self' jakejarvis.github.io buttons.github.io codepen.io hcaptcha.com *.hcaptcha.com platform.twitter.com www.youtube-nocookie.com; img-src 'self' data: https:; manifest-src 'self'; media-src 'self' data: https:; object-src 'none'; prefetch-src 'self'; script-src 'self' buttons.github.io gist.github.com hcaptcha.com *.hcaptcha.com syndication.twitter.com platform.twitter.com; style-src 'self' 'unsafe-inline' github.githubassets.com; worker-src 'self'; block-all-mixed-content; report-uri https://jarv.is/api/csp_wizard/; report-to default"
"value": "default-src 'self'; base-uri 'none'; connect-src 'self' api.github.com hcaptcha.com *.hcaptcha.com platform.twitter.com; font-src 'self'; form-action 'self'; frame-ancestors 'self'; frame-src 'self' jakejarvis.github.io buttons.github.io codepen.io hcaptcha.com *.hcaptcha.com platform.twitter.com www.youtube-nocookie.com; img-src 'self' data: https:; manifest-src 'self'; media-src 'self' data: https:; object-src 'none'; prefetch-src 'self'; script-src 'self' buttons.github.io gist.github.com hcaptcha.com *.hcaptcha.com syndication.twitter.com platform.twitter.com; style-src 'self' 'unsafe-inline' github.githubassets.com; worker-src 'self'; block-all-mixed-content; report-uri https://jarv.is/api/report/?csp; report-to default"
},
{
"key": "Report-To",