remove unsafe csp rules

hpi-schul-cloud · Jan 3, 2024 · 035bf1b · 035bf1b
1 parent cab60f6
commit 035bf1b
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/nginx.conf.template b/nginx.conf.template
@@ -2,7 +2,7 @@ server {
     listen 3046;
     server_name localhost;
 
-    set $csp "default-src 'self'; base-uri 'self'; script-src 'nonce-$request_id' 'strict-dynamic' 'unsafe-inline' https:; object-src 'none'; font-src 'self' data:; img-src 'self' data:; style-src 'self' 'unsafe-inline';";
+    set $csp "default-src 'self'; base-uri 'self'; script-src 'nonce-$request_id' 'strict-dynamic' https:; object-src 'none'; font-src 'self' data:; img-src 'self' data:; style-src 'self';";
 
     location /tldraw-client-runtime.config.json {
         return 200 '{ "tldrawServerURL" : "${TLDRAW_SERVER_URL}" }';