From a57f4e32891b412dd41629a142b599ff2acb4be1 Mon Sep 17 00:00:00 2001 From: Serghei Iakovlev Date: Sun, 24 Jul 2022 18:54:52 +0200 Subject: Avoid using wildcards for CSP header --- netlify.toml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/netlify.toml b/netlify.toml index 4f5521d..8edb56f 100644 --- a/netlify.toml +++ b/netlify.toml @@ -89,11 +89,11 @@ # (including inline scripts and event-handling HTML attributes). Content-Security-Policy = """ default-src 'self'; - script-src 'self' *.googletagmanager.com; + script-src 'self' www.googletagmanager.com; style-src 'self'; - img-src 'self' data: *.google-analytics.com *.googletagmanager.com *.gstatic.com; + img-src 'self' data: www.google-analytics.com www.googletagmanager.com www.gstatic.com stats.g.doubleclick.net; font-src 'self'; - connect-src 'self' *.google-analytics.com *.analytics.google.com analytics.google.com *.googletagmanager.com *.doubleclick.net; + connect-src 'self' www.google-analytics.com analytics.google.com www.googletagmanager.com stats.g.doubleclick.net; media-src 'self'; object-src 'self'; frame-src 'none'; -- cgit v1.2.3