fix: add csp config for esm.sh

2026-03-17 21:37:03 +00:00 · 2026-03-16 18:29:56 +08:00
1 changed files with 1 additions and 1 deletions
--- a/web/proxy.ts
+++ b/web/proxy.ts
@@ -3,7 +3,7 @@ import { Buffer } from 'node:buffer'
 import { NextResponse } from 'next/server'
 import { env } from '@/env'

-const NECESSARY_DOMAIN = '*.sentry.io http://localhost:* http://127.0.0.1:* https://analytics.google.com googletagmanager.com *.googletagmanager.com https://www.google-analytics.com https://api.github.com https://api2.amplitude.com *.amplitude.com'
+const NECESSARY_DOMAIN = 'https://esm.sh *.sentry.io http://localhost:* http://127.0.0.1:* https://analytics.google.com googletagmanager.com *.googletagmanager.com https://www.google-analytics.com https://api.github.com https://api2.amplitude.com *.amplitude.com'

 const wrapResponseWithXFrameOptions = (response: NextResponse, pathname: string) => {
  // prevent clickjacking: https://owasp.org/www-community/attacks/Clickjacking