Merge pull request #165 from Nike-Inc/fix-dashboard-in-safari

Allow CSP child-src blob from 'self' to fix Dashboard in Safari
Nike-Inc · Jun 5, 2018 · fb7646d · fb7646d
2 parents 959d2a2 + e2c6e0f
commit fb7646d
Show file tree

Hide file tree

Showing 2 changed files with 9 additions and 2 deletions.
diff --git a/gradle.properties b/gradle.properties
@@ -14,6 +14,6 @@
 # limitations under the License.
 #
 
-version=3.16.1
+version=3.16.2
 groupId=com.nike.cerberus
 artifactId=cms
diff --git a/src/main/java/com/nike/cerberus/security/SecurityHttpHeaders.java b/src/main/java/com/nike/cerberus/security/SecurityHttpHeaders.java
@@ -48,7 +48,14 @@ public class SecurityHttpHeaders extends DefaultHttpHeaders {
      * https://en.wikipedia.org/wiki/Content_Security_Policy
      */
     private static final String CONTENT_SECURITY_POLICY_HEADER_NAME = "Content-Security-Policy";
-    private static final String CONTENT_SECURITY_POLICY_HEADER_VALUE = "default-src 'none'; connect-src 'self'; font-src https://web.nike.com; img-src 'self'; script-src 'self'; style-src 'unsafe-inline' https://web.nike.com/; worker-src 'self' blob:; frame-ancestors 'none';";
+    private static final String CONTENT_SECURITY_POLICY_HEADER_VALUE = "default-src 'none';" +
+            " connect-src 'self';" +
+            " font-src https://web.nike.com;" +
+            " img-src 'self';" +
+            " script-src 'self';" +
+            " style-src 'unsafe-inline' https://web.nike.com/;" +
+            " worker-src 'self' blob:; frame-ancestors 'none';" +
+            " child-src 'self' blob:;";
 
     /**
      * Referrer Policy header can restrict referrer information sent by browser