diff --git a/src/main/java/com/bonus/digitalSignage/config/CspFilter.java b/src/main/java/com/bonus/digitalSignage/config/CspFilter.java index e9be2df..b3ce411 100644 --- a/src/main/java/com/bonus/digitalSignage/config/CspFilter.java +++ b/src/main/java/com/bonus/digitalSignage/config/CspFilter.java @@ -107,7 +107,7 @@ public class CspFilter implements Filter { String frameAncestors = allowIframe ? "'self'" : "'none'"; cspPolicy = "default-src 'self'; " + - "script-src 'self' 'unsafe-inline' 'unsafe-eval' blob: data:; " + + "script-src 'self' 'unsafe-inline' 'unsafe-eval' https: blob: data:; " + "style-src 'self' 'unsafe-inline' data: blob:; " + "img-src 'self' data: blob: https:; " + "font-src 'self' data: blob: https:; " + @@ -124,12 +124,13 @@ public class CspFilter implements Filter { String frameAncestors = allowIframe ? "'self'" : "'none'"; cspPolicy = "default-src 'self'; " + - "script-src 'self' 'unsafe-inline' 'unsafe-eval' https:; " + + "script-src 'self' 'unsafe-inline' 'unsafe-eval' https: blob: data:; " + "style-src 'self' 'unsafe-inline' https:; " + "img-src 'self' data: blob: https:; " + "font-src 'self' data: https:; " + "connect-src 'self' https:; " + "frame-ancestors " + frameAncestors + "; " + + "worker-src 'self' blob: data:;"+ "form-action 'self'; " + "object-src 'none'; " + "base-uri 'self'; " + @@ -233,4 +234,4 @@ public class CspFilter implements Filter { public void destroy() { // 清理资源 } -} \ No newline at end of file +}