Zaraz requires CSP adjustment

grantmakers · Mar 6, 2024 · fa530e8 · fa530e8
1 parent bb22071
commit fa530e8
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/apps/web/svelte.config.js b/apps/web/svelte.config.js
@@ -26,7 +26,7 @@ const config = {
     csp: {
       mode: 'auto',
       directives: {
-        'script-src': ['self', 'https://static.cloudflareinsights.com', 'https://cdn.iubenda.com'], // Hashes will be added automatically
+        'script-src': ['self', 'https://static.cloudflareinsights.com', 'https://cdn.iubenda.com', 'unsafe-inline'], // The unsafe-inline requirement is for Zaraz, a known CF issue required for now - Hashes will be added automatically
         'style-src': ['self', 'unsafe-inline', 'https://cdn.iubenda.com'], // Include 'unsafe-inline' for inline styles
         'frame-src': ['https://www.iubenda.com'],
         'connect-src': ['self', 'https://cloudflareinsights.com'],