From b743754ec2f4b9ffb8c9122a4d02e7f97ccf4622 Mon Sep 17 00:00:00 2001 From: Bryan Van Deusen Date: Thu, 16 Apr 2026 20:45:22 -0400 Subject: [PATCH] fix(csp): allow Google Fonts for Fraunces typeface Add fonts.googleapis.com to style-src and fonts.gstatic.com to font-src in Content-Security-Policy header. Co-Authored-By: Claude Opus 4.6 --- src/fabledassistant/app.py | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/src/fabledassistant/app.py b/src/fabledassistant/app.py index 69589ab..65d456f 100644 --- a/src/fabledassistant/app.py +++ b/src/fabledassistant/app.py @@ -145,8 +145,11 @@ def create_app() -> Quart: "Content-Security-Policy", "default-src 'self'; " "script-src 'self' 'unsafe-inline' 'wasm-unsafe-eval'; " - "style-src 'self' 'unsafe-inline'; img-src 'self' data: blob:; " - "connect-src 'self'; font-src 'self' data:; object-src 'none'; " + "style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; " + "img-src 'self' data: blob:; " + "connect-src 'self'; " + "font-src 'self' data: https://fonts.gstatic.com; " + "object-src 'none'; " "base-uri 'self'; worker-src 'self' blob:;" )