From: Cameron Otsuka <cameron@otsuka.haus>
Date: Tue, 29 Oct 2024 22:13:32 +0000 (-0700)
Subject: only allow https in csp
X-Git-Tag: v1.0.0~81
X-Git-Url: https://git.otsuka.systems/?a=commitdiff_plain;h=1ec4cae7560f92624a86ee4092328c70cdb98b8a;p=cotsuka.github.io

only allow https in csp
---

diff --git a/_includes/layouts/base.njk b/_includes/layouts/base.njk
index cecc4b0..8b70586 100644
--- a/_includes/layouts/base.njk
+++ b/_includes/layouts/base.njk
@@ -8,7 +8,7 @@
     {%- endif %}
     <meta charset="utf-8" />
     <meta name="viewport" content="width=device-width, initial-scale=1.0" />
-    <meta http-equiv="Content-Security-Policy" content="default-src 'self' 'unsafe-inline'; frame-src 'none'" />
+    <meta http-equiv="Content-Security-Policy" content="default-src  https: 'self'; frame-src 'none'" />
     <meta name="title" property="og:title" content="{{ title }}" />
     <meta name="description" property="og:description" content="{{ description or metadata.description }}" />
     <meta name="author" content="{{ metadata.author.name }}" />