only allow https in csp

diff --git a/_includes/layouts/base.njk b/_includes/layouts/base.njk
index cecc4b00c763db5fdaeeef5d1d88cc550da12c8b..8b705869153f96ae21541506c3a3266925a50258 100644 (file)
--- a/_includes/layouts/base.njk
+++ b/_includes/layouts/base.njk
@@ -8,7 +8,7 @@
     {%- endif %}
     <meta charset="utf-8" />
     <meta name="viewport" content="width=device-width, initial-scale=1.0" />
-    <meta http-equiv="Content-Security-Policy" content="default-src 'self' 'unsafe-inline'; frame-src 'none'" />
+    <meta http-equiv="Content-Security-Policy" content="default-src  https: 'self'; frame-src 'none'" />
     <meta name="title" property="og:title" content="{{ title }}" />
     <meta name="description" property="og:description" content="{{ description or metadata.description }}" />
     <meta name="author" content="{{ metadata.author.name }}" />