Add connect-src to CSP headers

cloud-gov · Nov 4, 2024 · cd6afca · cd6afca
1 parent 61de4e1
commit cd6afca
Showing 1 changed file with 3 additions and 2 deletions.
diff --git a/src/middlewares/withCSP.ts b/src/middlewares/withCSP.ts
@@ -8,15 +8,16 @@ export const withCSP: MiddlewareFactory = (next: NextMiddleware) => {
       const nonce = request.headers.get('x-nonce') as string;
       const cspHeader = `
         default-src 'self';
-        script-src 'self' 'nonce-${nonce}' 'strict-dynamic' ${process.env.NODE_ENV === 'development' ? "'unsafe-eval'" : ''};
+        connect-src 'self' *.us-gov-west-1.aws-us-gov.cloud.gov;
+        script-src 'self' 'nonce-${nonce}' 'strict-dynamic' https: http: ${process.env.NODE_ENV === 'production' ? '' : `'unsafe-eval'`};
         style-src 'self' 'nonce-${nonce}';
         img-src 'self' blob: data:;
         font-src 'self';
         object-src 'none';
         base-uri 'self';
         form-action 'self';
         frame-ancestors 'none';
-        ${process.env.NODE_ENV !== 'development' ? 'upgrade-insecure-requests;' : ''};
+        ${process.env.NODE_ENV === 'production' ? '' : 'upgrade-insecure-requests;'};
       `;
 
       // Replace newline characters and spaces