fix: CSP scriptSrcAttr explicitly allow unsafe-inline

2026-07-15 04:39:23 +08:00
parent 125b4f99fc
commit 880e3905dc
1 changed files with 1 additions and 1 deletions
--- a/backend/server.js
+++ b/backend/server.js
@@ -42,7 +42,7 @@ app.use(helmet({
      imgSrc: ["'self'", "data:", "blob:"],
      mediaSrc: ["'self'"],
      connectSrc: ["'self'"],
-      scriptSrcAttr: null,
+      scriptSrcAttr: ["'unsafe-inline'"],
    },
  },
  crossOriginEmbedderPolicy: false,