Merge pull request #84 from the-hideout/update-csp

update our csp to support turnstyle with cloudflare
the-hideout · Mar 22, 2024 · b828636 · b828636
2 parents 926c0f9 + 4e49675
commit b828636
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/terraform/transform_rules.tf b/terraform/transform_rules.tf
@@ -12,7 +12,7 @@ resource "cloudflare_ruleset" "security_response_headers" {
       # Note: headers must be in alphabetical order or you will have endless terraform plans changing state
       headers {
         name      = "Content-Security-Policy"
-        value     = "img-src 'self' https://assets.tarkov.dev https://avatars.githubusercontent.com data: https://images.weserv.nl; style-src 'self' https://tarkov.dev https://discord.com 'unsafe-inline'; font-src 'self' https://tarkov.dev https://discord.com; form-action 'self'; script-src 'self' *.cloudflareinsights.com wombatstats.com discord.com js-agent.newrelic.com bam.nr-data.net bam-cell.nr-data.net 'unsafe-inline'; object-src 'none'; base-uri 'self'; "
+        value     = "img-src 'self' https://assets.tarkov.dev https://avatars.githubusercontent.com data: https://images.weserv.nl; frame-src challenges.cloudflare.com; style-src 'self' https://tarkov.dev https://discord.com 'unsafe-inline'; font-src 'self' https://tarkov.dev https://discord.com; form-action 'self'; script-src 'self' *.cloudflareinsights.com challenges.cloudflare.com wombatstats.com discord.com js-agent.newrelic.com bam.nr-data.net bam-cell.nr-data.net 'unsafe-inline'; object-src 'none'; base-uri 'self'; "
         operation = "set"
       }
       headers {