diff --git a/app/Http/Middleware/SecureHeaders.php b/app/Http/Middleware/SecureHeaders.php index 3763ccb48a..5f889fed91 100644 --- a/app/Http/Middleware/SecureHeaders.php +++ b/app/Http/Middleware/SecureHeaders.php @@ -51,19 +51,17 @@ class SecureHeaders $response = $next($request); $trackingScriptSrc = $this->getTrackingScriptSource(); $csp = [ - "default-src 'none'", - "object-src 'self'", - sprintf("script-src 'unsafe-inline' 'nonce-%1s' %2s 'strict-dynamic'", $nonce, $trackingScriptSrc), - "style-src 'unsafe-inline' 'self'", - "frame-ancestors 'none'", - "base-uri 'self'", - "font-src 'self' data:", - "connect-src 'self'", - sprintf( - "img-src 'self' data: https://a.tile.openstreetmap.org https://b.tile.openstreetmap.org https://c.tile.openstreetmap.org https://api.tiles.mapbox.com %s", - $trackingScriptSrc - ), - "manifest-src 'self'", +// "default-src 'none'", +// "object-src 'none'", +// "require-trusted-types-for 'script'", +// sprintf("script-src 'unsafe-inline' 'strict-dynamic' 'nonce-%1s' %2s", $nonce, $trackingScriptSrc), +// "style-src 'unsafe-inline' 'self'", +// "frame-ancestors 'none'", +// "base-uri 'self'", +// "font-src 'self' data:", +// "connect-src 'self'", +// sprintf("img-src 'self' data: https://a.tile.openstreetmap.org https://b.tile.openstreetmap.org https://c.tile.openstreetmap.org https://api.tiles.mapbox.com %s", $trackingScriptSrc), +// "manifest-src 'self'", ]; $route = $request->route();