From 2770d4db647cf0f48f9ce09cf0e9d7c70f610840 Mon Sep 17 00:00:00 2001 From: Christopher Speller Date: Mon, 3 Dec 2018 09:59:30 -0800 Subject: [PATCH] Updating content security policy. (#9906) --- web/handlers.go | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/web/handlers.go b/web/handlers.go index 8180739b7a..ab862270c0 100644 --- a/web/handlers.go +++ b/web/handlers.go @@ -84,7 +84,8 @@ func (h Handler) ServeHTTP(w http.ResponseWriter, r *http.Request) { if h.IsStatic { // Instruct the browser not to display us in an iframe unless is the same origin for anti-clickjacking w.Header().Set("X-Frame-Options", "SAMEORIGIN") - w.Header().Set("Content-Security-Policy", "frame-ancestors 'self'") + // Set content security policy. This is also specified in the root.html of the webapp in a meta tag. + w.Header().Set("Content-Security-Policy", "frame-ancestors 'self'; script-src 'self' cdn.segment.com/analytics.js/") } else { // All api response bodies will be JSON formatted by default w.Header().Set("Content-Type", "application/json")