v1.7.13: switch Alpine.js to CSP build, remove unsafe-eval from CSP

2026-04-27 15:48:22 +02:00
parent 07a841615b
commit 9171cc1c02
4 changed files with 45 additions and 3 deletions
--- a/backend/main.py
+++ b/backend/main.py
@@ -109,7 +109,7 @@ async def security_headers_middleware(request: Request, call_next):
    if request.url.path.startswith("/api/") or request.url.path in ("/", "/index.html"):
        response.headers["Content-Security-Policy"] = (
            "default-src 'self'; "
-            "script-src 'self' 'unsafe-inline' 'unsafe-eval' cdn.jsdelivr.net alcdn.msauth.net; "
+            "script-src 'self' 'unsafe-inline' cdn.jsdelivr.net alcdn.msauth.net; "
            "style-src 'self' 'unsafe-inline'; "
            "connect-src 'self' https://login.microsoftonline.com; "
            "frame-src 'self' https://login.microsoftonline.com; "