@@ -38,14 +38,6 @@ export const buildTimeCSPDirectives: CSPDirectives = {
3838 "'unsafe-eval'" ,
3939 'https://*.google.com' ,
4040 'https://apis.google.com' ,
41- 'https://*.vercel-scripts.com' ,
42- 'https://*.vercel-insights.com' ,
43- 'https://vercel.live' ,
44- 'https://*.vercel.live' ,
45- 'https://vercel.com' ,
46- 'https://*.vercel.app' ,
47- 'https://vitals.vercel-insights.com' ,
48- 'https://b2bjsstore.s3.us-west-2.amazonaws.com' ,
4941 ] ,
5042
5143 'style-src' : [ "'self'" , "'unsafe-inline'" , 'https://fonts.googleapis.com' ] ,
@@ -90,25 +82,15 @@ export const buildTimeCSPDirectives: CSPDirectives = {
9082 env . NEXT_PUBLIC_SOCKET_URL || 'http://localhost:3002' ,
9183 env . NEXT_PUBLIC_SOCKET_URL ?. replace ( 'http://' , 'ws://' ) . replace ( 'https://' , 'wss://' ) ||
9284 'ws://localhost:3002' ,
93- 'https://*.up.railway.app' ,
94- 'wss://*.up.railway.app' ,
9585 'https://api.browser-use.com' ,
9686 'https://api.exa.ai' ,
9787 'https://api.firecrawl.dev' ,
9888 'https://*.googleapis.com' ,
9989 'https://*.amazonaws.com' ,
10090 'https://*.s3.amazonaws.com' ,
10191 'https://*.blob.core.windows.net' ,
102- 'https://*.vercel-insights.com' ,
103- 'https://vitals.vercel-insights.com' ,
10492 'https://*.atlassian.com' ,
10593 'https://*.supabase.co' ,
106- 'https://vercel.live' ,
107- 'https://*.vercel.live' ,
108- 'https://vercel.com' ,
109- 'https://*.vercel.app' ,
110- 'wss://*.vercel.app' ,
111- 'https://pro.ip-api.com' ,
11294 'https://api.github.com' ,
11395 'https://github.com/*' ,
11496 ...getHostnameFromUrl ( env . NEXT_PUBLIC_BRAND_LOGO_URL ) ,
@@ -168,12 +150,12 @@ export function generateRuntimeCSP(): string {
168150
169151 return `
170152 default-src 'self';
171- script-src 'self' 'unsafe-inline' 'unsafe-eval' https://*.google.com https://apis.google.com https://*.vercel-scripts.com https://*.vercel-insights.com https://vercel.live https://*.vercel.live https://vercel.com https://*.vercel.app https://vitals.vercel-insights.com https://b2bjsstore.s3.us-west-2.amazonaws.com ;
153+ script-src 'self' 'unsafe-inline' 'unsafe-eval' https://*.google.com https://apis.google.com;
172154 style-src 'self' 'unsafe-inline' https://fonts.googleapis.com;
173155 img-src 'self' data: blob: https://*.googleusercontent.com https://*.google.com https://*.atlassian.com https://cdn.discordapp.com https://*.githubusercontent.com https://*.public.blob.vercel-storage.com ${ brandLogoDomain } ${ brandFaviconDomain } ;
174156 media-src 'self' blob:;
175157 font-src 'self' https://fonts.gstatic.com;
176- connect-src 'self' ${ appUrl } ${ ollamaUrl } ${ socketUrl } ${ socketWsUrl } https://*.up.railway.app wss://*.up.railway.app https:// api.browser-use.com https://api.exa.ai https://api.firecrawl.dev https://*.googleapis.com https://*.amazonaws.com https://*.s3.amazonaws.com https://*.blob.core.windows.net https://api.github.com https://github.com/* https://*.vercel-insights.com https://vitals.vercel-insights.com https://*. atlassian.com https://*.supabase.co https://vercel.live https://*.vercel.live https://vercel.com https://*.vercel.app wss://*.vercel.app https://pro.ip-api.com ${ dynamicDomainsStr } ;
158+ connect-src 'self' ${ appUrl } ${ ollamaUrl } ${ socketUrl } ${ socketWsUrl } https://api.browser-use.com https://api.exa.ai https://api.firecrawl.dev https://*.googleapis.com https://*.amazonaws.com https://*.s3.amazonaws.com https://*.blob.core.windows.net https://api.github.com https://github.com/* https://*.atlassian.com https://*.supabase.co ${ dynamicDomainsStr } ;
177159 frame-src https://drive.google.com https://docs.google.com https://*.google.com;
178160 frame-ancestors 'self';
179161 form-action 'self';
0 commit comments