add child-src as a default src for CSP

weilu · weilu · commit f89e46f7817d · 2015-09-16T10:00:25.000+08:00
diff --git a/server/express.js b/server/express.js
@@ -26,6 +26,7 @@ module.exports = function (){
     }
     app.use(helmet.csp({
       'default-src': ["'self'"],
+      'child-src': ["'self'", "blob:"],
       'connect-src': [
         "'self'", "blob:",
         'api.bitcoinaverage.com', 'chain.so', // tickers

Original file line number	Diff line number	Diff line change
`@@ -26,6 +26,7 @@ module.exports = function (){`
`26`	`26`	`}`
`27`	`27`	`app.use(helmet.csp({`
`28`	`28`	`'default-src': ["'self'"],`
	`29`	`+ 'child-src': ["'self'", "blob:"],`
`29`	`30`	`'connect-src': [`
`30`	`31`	`"'self'", "blob:",`
`31`	`32`	`'api.bitcoinaverage.com', 'chain.so', // tickers`