Merge pull request 'Fix CSP for Google Fonts' (#40 ) from dev into main

fix(csp): allow Google Fonts for Fraunces typeface
Add fonts.googleapis.com to style-src and fonts.gstatic.com to font-src in Content-Security-Policy header. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-04-17 11:16:33 +00:00 · 2026-04-16 20:45:22 -04:00
1 changed files with 5 additions and 2 deletions
@@ -145,8 +145,11 @@ def create_app() -> Quart:
            "Content-Security-Policy",
            "default-src 'self'; "
            "script-src 'self' 'unsafe-inline' 'wasm-unsafe-eval'; "
-            "style-src 'self' 'unsafe-inline'; img-src 'self' data: blob:; "
-            "connect-src 'self'; font-src 'self' data:; object-src 'none'; "
+            "style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; "
+            "img-src 'self' data: blob:; "
+            "connect-src 'self'; "
+            "font-src 'self' data: https://fonts.gstatic.com; "
+            "object-src 'none'; "
            "base-uri 'self'; worker-src 'self' blob:;"
        )
Author	SHA1	Message	Date
bvandeusen	fc82f7a0cb	Merge pull request 'Fix CSP for Google Fonts' (#40 ) from dev into main	2026-04-17 11:16:33 +00:00
bvandeusen	b743754ec2	fix(csp): allow Google Fonts for Fraunces typeface Add fonts.googleapis.com to style-src and fonts.gstatic.com to font-src in Content-Security-Policy header. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-04-16 20:45:22 -04:00