From 868343a29b223022a46adcd5e97731d46508bfc7 Mon Sep 17 00:00:00 2001 From: Wyatt Johnson Date: Fri, 18 May 2018 16:42:23 -0600 Subject: [PATCH] fixes to csp policy --- middleware/contentSecurityPolicy.js | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/middleware/contentSecurityPolicy.js b/middleware/contentSecurityPolicy.js index d6036ca76..c47faa74e 100644 --- a/middleware/contentSecurityPolicy.js +++ b/middleware/contentSecurityPolicy.js @@ -3,11 +3,15 @@ const { WEBSOCKET_LIVE_URI, ENABLE_STRICT_CSP } = require('../config'); const { BASE_PATH, BASE_URL, STATIC_URL } = require('../url'); const { URL } = require('url'); -// websocketSrc represents the host where we can connect for websocket requests. -const websocketSrc = new URL(WEBSOCKET_LIVE_URI || BASE_URL).host; +// websocketUri represents the host where we can connect for websocket requests. +const websocketUri = new URL(WEBSOCKET_LIVE_URI || BASE_URL); +websocketUri.protocol = websocketUri.protocol.startsWith('https') + ? 'wss' + : 'ws'; +const { origin: websocketSrc } = websocketUri; // staticSrc represents any static asset hosted on the static host. -const staticSrc = new URL(STATIC_URL).host; +const { host: staticSrc } = new URL(STATIC_URL); // nonceSrc represents the nonce source that is used to indicate a safe resource // to load.