WIP added gatsby plugin

ConductionNL · Apr 8, 2024 · 98a2b2b · 98a2b2b
1 parent e16ce97
commit 98a2b2b
Show file tree

Hide file tree

Showing 3 changed files with 38 additions and 0 deletions.
diff --git a/pwa/gatsby-config.js b/pwa/gatsby-config.js
@@ -60,5 +60,27 @@ module.exports = {
         hiring: `${process.env.GATSBY_SECURITY_TXT_HIRING ?? ""}`,
       },
     },
+    {
+      resolve: `gatsby-plugin-csp`,
+      options: {
+        disableOnDev: true,
+        reportOnly: false, // Changes header to Content-Security-Policy-Report-Only for csp testing purposes
+        mergeScriptHashes: true, // you can disable scripts sha256 hashes
+        mergeStyleHashes: true, // you can disable styles sha256 hashes
+        mergeDefaultDirectives: true,
+        directives: {
+          "default-src": "'self'",
+          "base-uri": "'self'",
+          "frame-src": "'self'",
+          "frame-ancestors": "'self'",
+          "img-src":
+            "'self' https://www.conduction.nl https://conduction.nl https://raw.githubusercontent.com/ConductionNL/woo-website-*",
+          "form-action": "'self'",
+          "connect-src":
+            "'self' https://api.gateway.commonground.nu https://raw.githubusercontent.com/ConductionNL",
+          // you can add your directives or override defaults
+        },
+      },
+    },
   ],
 };
diff --git a/pwa/package-lock.json b/pwa/package-lock.json
diff --git a/pwa/package.json b/pwa/package.json
@@ -70,6 +70,7 @@
     "es-abstract": "^1.23.3",
     "gatsby": "^5.13.3",
     "gatsby-plugin-breadcrumb": "^12.3.2",
+    "gatsby-plugin-csp": "^1.1.4",
     "gatsby-plugin-html-attributes": "^1.0.5",
     "gatsby-plugin-layout": "^4.13.1",
     "gatsby-plugin-security-txt": "^1.2.1",