Add some CSP headers

This should block iframes (not currently used anywhere) and scripts on different domains.
sheodox · Mar 4, 2024 · 27b961b · 27b961b
1 parent 18782bc
commit 27b961b
Showing 1 changed file with 7 additions and 0 deletions.
diff --git a/svelte.config.js b/svelte.config.js
@@ -12,6 +12,13 @@ const config = {
 		adapter: process.env.ALEXANDRITE_RUN_IN_NODE === 'true' ? adapterNode() : adapterAuto(),
 		env: {
 			publicPrefix: 'ALEXANDRITE_'
+		},
+		csp: {
+			directives: {
+				'script-src': ['self'],
+				'frame-ancestors': ['none'],
+				'frame-src': ['none']
+			}
 		}
 	}
 };