fix: CSP script-src-attr:none blocked all onclick handlers since day 1

2026-07-15 03:58:16 +08:00
parent 021351d898
commit c892b18d33
1 changed files with 1 additions and 0 deletions
--- a/backend/server.js
+++ b/backend/server.js
@@ -42,6 +42,7 @@ app.use(helmet({
      imgSrc: ["'self'", "data:", "blob:"],
      mediaSrc: ["'self'"],
      connectSrc: ["'self'"],
+      scriptSrcAttr: null,
    },
  },
  crossOriginEmbedderPolicy: false,