From 4f73625c97acace51786781130a6ded24e20e66e Mon Sep 17 00:00:00 2001 From: Karl Ludwig Weise Date: Tue, 7 Apr 2026 14:43:53 +0200 Subject: [PATCH] Changed object csp object-src to self --- src/hooks.server.test.ts | 2 +- src/server-hooks/secHeaderHandle.ts | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/src/hooks.server.test.ts b/src/hooks.server.test.ts index 7b3c71e..2b7530c 100644 --- a/src/hooks.server.test.ts +++ b/src/hooks.server.test.ts @@ -233,7 +233,7 @@ describe("hooks.server", () => { expect(response.headers.get("X-XSS-Protection")).toBe("1; mode=block"); expect(response.headers.get("Referrer-Policy")).toBe("strict-origin-when-cross-origin"); expect(response.headers.get("Content-Security-Policy")).toContain( - "script-src 'self' 'unsafe-inline' 'wasm-unsafe-eval' https://unpkg.com; style-src 'self' 'unsafe-inline' https://unpkg.com; font-src 'self' data: https://unpkg.com; connect-src 'self'; media-src 'self'; object-src 'none'; base-uri 'self'; form-action 'self'; frame-ancestors 'none'; upgrade-insecure-requests", + "script-src 'self' 'unsafe-inline' 'wasm-unsafe-eval' https://unpkg.com; style-src 'self' 'unsafe-inline' https://unpkg.com; font-src 'self' data: https://unpkg.com; connect-src 'self'; media-src 'self'; object-src 'self'; base-uri 'self'; form-action 'self'; frame-ancestors 'none'; upgrade-insecure-requests", ); }); diff --git a/src/server-hooks/secHeaderHandle.ts b/src/server-hooks/secHeaderHandle.ts index 1fd75f1..7033c6d 100644 --- a/src/server-hooks/secHeaderHandle.ts +++ b/src/server-hooks/secHeaderHandle.ts @@ -32,7 +32,7 @@ export const secHeaderHandle: Handle = async ({ event, resolve }) => { "font-src 'self' data: https://unpkg.com", "connect-src 'self'", "media-src 'self'", - "object-src 'none'", + "object-src 'self'", "base-uri 'self'", "form-action 'self'", "frame-ancestors 'none'",