fix: explicitly allow wss in CSP connectSrc

2026-06-22 19:47:00 -04:00 · 2026-06-22 19:47:00 -04:00 · b3373d6d85
parent 2dba57191b
commit b3373d6d85
1 changed files with 1 additions and 0 deletions
--- a/backend/src/middleware/security.js
+++ b/backend/src/middleware/security.js
@ -10,6 +10,7 @@ export const setupSecurity = (app) => {
        defaultSrc: ["'self'"],
        styleSrc: ["'self'", "'unsafe-inline'"],
        scriptSrc: ["'self'", "https://static.cloudflareinsights.com", "'unsafe-inline'"],
+        connectSrc: ["'self'", "ws:", "wss:", "http:", "https:"],
        imgSrc: ["'self'", 'data:', 'https:'],
      },
    },