Add hotjar font CSP domain

delta-cs · Oct 2, 2024 · daca37a · daca37a
1 parent 42a3053
commit daca37a
Show file tree

Hide file tree

Showing 2 changed files with 7 additions and 0 deletions.
diff --git a/webapp/config/services.yaml b/webapp/config/services.yaml
@@ -53,4 +53,5 @@ services:
                 scriptSrc: "'self' 'unsafe-inline' https://*.googletagmanager.com https://*.hotjar.com https://*.hotjar.io wss://*.hotjar.com"
                 imgSrc: "'self' https://*.google-analytics.com https://*.analytics.google.com https://*.googletagmanager.com https://*.g.doubleclick.net https://*.google.com data: https://*.hotjar.com https://*.hotjar.io wss://*.hotjar.com"
                 connectSrc: "'self' https://*.google-analytics.com https://*.analytics.google.com https://*.googletagmanager.com https://*.g.doubleclick.net https://*.google.com https://*.hotjar.com https://*.hotjar.io wss://*.hotjar.com"
+                fontSrc: "'self' https://*.hotjar.com"
                 frameAncestors: "'self'"
diff --git a/webapp/src/EventListener/AddContentSecurityPolicyListener.php b/webapp/src/EventListener/AddContentSecurityPolicyListener.php
@@ -24,6 +24,7 @@ public function __invoke(ResponseEvent $event): void
             $this->getScriptSrcCsp(),
             $this->getImageSrcCsp(),
             $this->getConnectSrcCsp(),
+            $this->getFontSrcScp(),
             $this->getFrameAncestorsCsp()
         ]);
 
@@ -58,6 +59,11 @@ private function getConnectSrcCsp(): string
         return "connect-src " . $this->cspConfig['connectSrc'];
     }
 
+    private function getFontSrcScp(): string
+    {
+        return "font-src " . $this->cspConfig['fontSrc'];
+    }
+
     private function getFrameAncestorsCsp(): string
     {
         return "frame-ancestors " . $this->cspConfig['frameAncestors'];