graham/towerops
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix: allow Plausible analytics domain in CSP

Browse source 
Add https://a.w5isp.com to script-src and connect-src so the analytics
script loads and event POSTs are not blocked.
This commit is contained in:
Graham McIntire 2026-04-29 14:24:04 -05:00
parent 95babfcc49
commit 0d961e887f
2 changed files with 4 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
lib/towerops_web/plugs/security_headers.ex
View file

@ -27,11 +27,11 @@ defmodule ToweropsWeb.Plugs.SecurityHeaders do
Enum.join(
[
"default-src 'self' data:",
"script-src 'self' 'unsafe-inline'",
"script-src 'self' 'unsafe-inline' https://a.w5isp.com",
"style-src 'self' 'unsafe-inline' 'unsafe-hashes'",
"img-src 'self' data: https:",
"font-src 'self' data:",
"connect-src 'self' ws: wss:",
"connect-src 'self' ws: wss: https://a.w5isp.com",
"frame-ancestors 'none'"
],
"; "

4
test/towerops_web/plugs/security_headers_test.exs
View file

@ -15,12 +15,12 @@ defmodule ToweropsWeb.Plugs.SecurityHeadersTest do
[csp] = get_resp_header(conn, "content-security-policy")
assert csp =~ "default-src 'self'"
assert csp =~ "script-src 'self' 'unsafe-inline'"
assert csp =~ "script-src 'self' 'unsafe-inline' https://a.w5isp.com"
refute csp =~ "unsafe-eval"
assert csp =~ "style-src 'self' 'unsafe-inline' 'unsafe-hashes'"
assert csp =~ "img-src 'self' data: https:"
assert csp =~ "font-src 'self' data:"
assert csp =~ "connect-src 'self' ws: wss:"
assert csp =~ "connect-src 'self' ws: wss: https://a.w5isp.com"
assert csp =~ "frame-ancestors 'none'"
end
end