fix: csp headers for google analytics

Open-Attestation · Aug 6, 2024 · f4aef1f · f4aef1f
1 parent c39c46c
commit f4aef1f
Showing 1 changed file with 6 additions and 1 deletion.
diff --git a/public/_headers b/public/_headers
@@ -1,3 +1,8 @@
 /*
   X-Frame-Options: DENY
-  Content-Security-Policy: default-src 'self'; connect-src *; frame-ancestors 'none';
+  # Multi-value headers: https://docs.netlify.com/routing/headers/#multi-value-headers
+  Content-Security-Policy: '''
+  default-src 'self';
+  script-src: https://*.googletagmanager.com;
+  connect-src * https://*.google-analytics.com https://*.analytics.google.com https://*.googletagmanager.com;
+  frame-ancestors 'none';'''