Merge pull request 'fix: allow Google Fonts in CSP' (#20) from fix/csp-google-fonts into main

Reviewed-on: #20
2026-03-01 11:35:13 +00:00
parent ec89a5fe35 78c4313874
commit c0cd4e5037
1 changed files with 2 additions and 2 deletions
--- a/apps/core/middleware.py
+++ b/apps/core/middleware.py
@@ -25,9 +25,9 @@ class SecurityHeadersMiddleware:
        response["Content-Security-Policy"] = (
            f"default-src 'self'; "
            f"script-src 'self' 'nonce-{nonce}'; "
-            "style-src 'self'; "
+            "style-src 'self' https://fonts.googleapis.com; "
            "img-src 'self' data: blob:; "
-            "font-src 'self'; "
+            "font-src 'self' https://fonts.gstatic.com; "
            "connect-src 'self'; "
            "object-src 'none'; "
            "base-uri 'self'; "