hashicorp-copywrite[bot]andCameron Perera
3d610427d0
* [COMPLIANCE] Add Copyright and License Headers * chore: 🤖 update Copyright headers to satisfy our lint rules --------- Co-authored-by: hashicorp-copywrite[bot] <110428419+hashicorp-copywrite[bot]@users.noreply.github.com> Co-authored-by: Cameron Perera <cameron.perera@hashicorp.com>
41 lines
1019 B
JavaScript
41 lines
1019 B
JavaScript
/**
|
|
* Copyright (c) HashiCorp, Inc.
|
|
* SPDX-License-Identifier: MPL-2.0
|
|
*/
|
|
|
|
'use strict';
|
|
|
|
const API_HOST = process.env.API_HOST || '';
|
|
|
|
module.exports = function (environment) {
|
|
let policy = {
|
|
// Deny everything by default
|
|
'default-src': ["'none'"],
|
|
'script-src': ["'self'"],
|
|
'frame-src': ["'self'"],
|
|
'font-src': ["'self'"],
|
|
'connect-src': ["'self'"],
|
|
'img-src': ["'self'", 'data:'],
|
|
'style-src': ["'self'"],
|
|
'media-src': ["'self'"],
|
|
'manifest-src': ["'self'"],
|
|
'style-src-attr': ["'self'"],
|
|
};
|
|
|
|
// Unsafe policy is necessary in development and test environments, but should
|
|
// not be used in production.
|
|
if (environment === 'development') {
|
|
policy['script-src'].push("'unsafe-eval'");
|
|
policy['style-src'].push("'unsafe-inline'");
|
|
if (API_HOST) policy['connect-src'].push(API_HOST);
|
|
}
|
|
|
|
//enable csp meta tag only in dev env
|
|
return {
|
|
delivery: ['meta'],
|
|
enabled: environment === 'development',
|
|
policy,
|
|
reportOnly: false,
|
|
};
|
|
};
|