chore: build

2026-08-18 16:37:00 +02:00
parent 955f2325fb
commit aa1aa60f00
8 changed files with 189 additions and 4 deletions
@@ -47,7 +47,12 @@ server {
    add_header X-Frame-Options            "DENY"                                         always;
    add_header X-Content-Type-Options     "nosniff"                                      always;
    add_header Referrer-Policy            "no-referrer"                                  always;
-    add_header Content-Security-Policy    "default-src 'none'; frame-ancestors 'none'"   always;
+    # Le SPA (Vite/React) est servi en même origine (proxifié ci-dessous) et
+    # utilise Chakra UI/Emotion, qui injecte des <style> au runtime (CSS-in-JS)
+    # — d'où "style-src 'unsafe-inline'". Pas de script inline dans
+    # web/index.html (un seul <script type="module" src="/src/main.tsx">),
+    # donc script-src reste strict à 'self'.
+    add_header Content-Security-Policy    "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; font-src 'self' data:; connect-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'none'" always;

    # ---------------------------------------------------
    # Limites et timeouts