From efef39611341f0a65fc16771a2f174634b82c57a Mon Sep 17 00:00:00 2001 From: Tim Hansen Date: Fri, 4 Jun 2021 20:04:52 -0600 Subject: [PATCH] Add note about disabling CSP defaults Signed-off-by: Tim Hansen --- app-config.yaml | 4 ++-- packages/create-app/templates/default-app/app-config.yaml.hbs | 2 ++ 2 files changed, 4 insertions(+), 2 deletions(-) diff --git a/app-config.yaml b/app-config.yaml index f9dd479e0e..c951594677 100644 --- a/app-config.yaml +++ b/app-config.yaml @@ -37,8 +37,8 @@ backend: credentials: true csp: connect-src: ["'self'", 'http:', 'https:'] - # Other Content-Security-Policy directives can be added according to the Helmet format: - # https://helmetjs.github.io/#reference + # Content-Security-Policy directives follow the Helmet format: https://helmetjs.github.io/#reference + # Default Helmet Content-Security-Policy values can be removed by setting the key to false reading: allow: - host: example.com diff --git a/packages/create-app/templates/default-app/app-config.yaml.hbs b/packages/create-app/templates/default-app/app-config.yaml.hbs index d37cffd680..8c6b2f8f2d 100644 --- a/packages/create-app/templates/default-app/app-config.yaml.hbs +++ b/packages/create-app/templates/default-app/app-config.yaml.hbs @@ -11,6 +11,8 @@ backend: port: 7000 csp: connect-src: ["'self'", 'http:', 'https:'] + # Content-Security-Policy directives follow the Helmet format: https://helmetjs.github.io/#reference + # Default Helmet Content-Security-Policy values can be removed by setting the key to false cors: origin: http://localhost:3000 methods: [GET, POST, PUT, DELETE]