From 2b3b4ea92450cc229c4297ea6160f51daa6787c4 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?J=C3=A9r=C3=A9mie=20Astori?= Date: Fri, 9 Sep 2016 01:17:31 -0400 Subject: [PATCH] Explicitly authorize websockets in CSP header This follows a recent change in WebKit (see https://webkit.org/blog/6830/a-refined-content-security-policy/, section "More restrictive wildcard *") to remove websocket schemes from the connect-src directive. Users of Safari v10 (to be publicly released in a few days) would be affected by this and could not load the app. --- src/server.js | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/server.js b/src/server.js index 4dcade40..4dbbc1af 100644 --- a/src/server.js +++ b/src/server.js @@ -128,7 +128,7 @@ function index(req, res, next) { return css.slice(0, -4); }); var template = _.template(file); - res.setHeader("Content-Security-Policy", "default-src *; style-src * 'unsafe-inline'; script-src 'self'; child-src 'none'; object-src 'none'; form-action 'none'; referrer no-referrer;"); + res.setHeader("Content-Security-Policy", "default-src *; connect-src 'self' ws: wss:; style-src * 'unsafe-inline'; script-src 'self'; child-src 'none'; object-src 'none'; form-action 'none'; referrer no-referrer;"); res.setHeader("Content-Type", "text/html"); res.writeHead(200); res.end(template(data));