trails-cool/trails
1
1
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Allow Planner to connect to Journal in CSP

Browse source 
The Planner's save-to-journal callback makes a cross-origin request to
trails.cool from planner.trails.cool. Add the Journal's origin to the
Planner's connect-src CSP directive.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
This commit is contained in:
Ullrich Schäfer 2026-03-27 21:34:41 +01:00
parent 39b57b73b7
commit f344c27478
No known key found for this signature in database
GPG key ID: A32FF691A0F752D9
1 changed files with 8 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

9
infrastructure/Caddyfile
View file

@ -40,7 +40,14 @@ grafana.internal.{$DOMAIN:trails.cool} {
}
planner.{$DOMAIN:trails.cool} {
import security_headers
header {
Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
X-Content-Type-Options "nosniff"
X-Frame-Options "DENY"
Referrer-Policy "strict-origin-when-cross-origin"
Permissions-Policy "camera=(), microphone=(), geolocation=()"
Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' blob:; worker-src 'self' blob:; style-src 'self' 'unsafe-inline'; img-src 'self' data: https://*.tile.openstreetmap.org; connect-src 'self' wss: https://{$DOMAIN:trails.cool} https://*.sentry.io https://*.ingest.de.sentry.io; font-src 'self';"
}
import block_scanners
log {
output stdout