We read every piece of feedback, and take your input very seriously.
To see all available qualifiers, see ourdocumentation.
There was an error while loading.Please reload this page.
1 parentf6cbfeb commit33e7854Copy full SHA for 33e7854
stubbornjava-webapp/src/main/java/com/stubbornjava/webapp/StubbornJavaWebApp.java
@@ -36,9 +36,11 @@ private static HttpHandler exceptionHandler(HttpHandler next) {
36
privatestaticHttpHandlercontentSecurityPolicy(HttpHandlerdelegate) {
37
returnnewContentSecurityPolicyHandler.Builder()
38
.defaultSrc(ContentSecurityPolicy.SELF)
39
- .scriptSrc("'self'","https://www.google-analytics.com")
40
- .imgSrc("'self'","https://www.google-analytics.com")
41
- .connectSrc("'self'","https://www.google-analytics.com")
+ .scriptSrc(ContentSecurityPolicy.SELF.getValue(),"https://www.google-analytics.com")
+// Drop the wildcard when we host our own images.
+ .imgSrc(ContentSecurityPolicy.SELF.getValue(),"https://www.google-analytics.com","*")
42
+ .connectSrc(ContentSecurityPolicy.SELF.getValue(),"https://www.google-analytics.com")
43
+ .fontSrc(ContentSecurityPolicy.SELF.getValue(),"data:")
44
.styleSrc(ContentSecurityPolicy.SELF.getValue(),ContentSecurityPolicy.UNSAFE_INLINE.getValue())
45
.build(delegate);
46
}