From a1e601563e8976b09b7741a21040fc7c45676f47 Mon Sep 17 00:00:00 2001 From: Graham McIntire Date: Fri, 1 May 2026 17:03:14 -0500 Subject: [PATCH] fix: allow leaflet CDN and OSM tiles in CSP The /sites-map page loads leaflet from unpkg.com (CSS + JS) and fetches tiles from *.tile.openstreetmap.org. Update Content-Security-Policy to permit those origins so the map can render. Adds: - script-src https://unpkg.com (leaflet.js) - style-src https://unpkg.com (leaflet.css) - connect-src https://*.tile.openstreetmap.org (tile fetches) --- lib/towerops_web/plugs/security_headers.ex | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/lib/towerops_web/plugs/security_headers.ex b/lib/towerops_web/plugs/security_headers.ex index ff01c0da..cb3c0e8d 100644 --- a/lib/towerops_web/plugs/security_headers.ex +++ b/lib/towerops_web/plugs/security_headers.ex @@ -27,11 +27,11 @@ defmodule ToweropsWeb.Plugs.SecurityHeaders do Enum.join( [ "default-src 'self' data:", - "script-src 'self' 'unsafe-inline' https://a.w5isp.com", - "style-src 'self' 'unsafe-inline' 'unsafe-hashes'", + "script-src 'self' 'unsafe-inline' https://a.w5isp.com https://unpkg.com", + "style-src 'self' 'unsafe-inline' 'unsafe-hashes' https://unpkg.com", "img-src 'self' data: https:", "font-src 'self' data:", - "connect-src 'self' ws: wss: https://a.w5isp.com", + "connect-src 'self' ws: wss: https://a.w5isp.com https://*.tile.openstreetmap.org", "frame-ancestors 'none'" ], "; "