graham/towerops
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix: allow leaflet CDN and OSM tiles in CSP

Browse source 
The /sites-map page loads leaflet from unpkg.com (CSS + JS) and fetches
tiles from *.tile.openstreetmap.org. Update Content-Security-Policy to
permit those origins so the map can render.

Adds:
- script-src https://unpkg.com (leaflet.js)
- style-src https://unpkg.com (leaflet.css)
- connect-src https://*.tile.openstreetmap.org (tile fetches)
This commit is contained in:
Graham McIntire 2026-05-01 17:03:14 -05:00
parent 8729e36aff
commit a1e601563e
1 changed files with 3 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
lib/towerops_web/plugs/security_headers.ex
View file

@ -27,11 +27,11 @@ defmodule ToweropsWeb.Plugs.SecurityHeaders do
Enum.join(
[
"default-src 'self' data:",
"script-src 'self' 'unsafe-inline' https://a.w5isp.com",
"style-src 'self' 'unsafe-inline' 'unsafe-hashes'",
"script-src 'self' 'unsafe-inline' https://a.w5isp.com https://unpkg.com",
"style-src 'self' 'unsafe-inline' 'unsafe-hashes' https://unpkg.com",
"img-src 'self' data: https:",
"font-src 'self' data:",
"connect-src 'self' ws: wss: https://a.w5isp.com",
"connect-src 'self' ws: wss: https://a.w5isp.com https://*.tile.openstreetmap.org",
"frame-ancestors 'none'"
],
"; "