diff --git a/aurweb/asgi.py b/aurweb/asgi.py index 228b9a65..5f0ad01d 100644 --- a/aurweb/asgi.py +++ b/aurweb/asgi.py @@ -83,10 +83,7 @@ async def add_security_headers(request: Request, call_next: typing.Callable): # Add CSP header. nonce = request.user.nonce csp = "default-src 'self'; " - script_hosts = [ - "ajax.googleapis.com", - "cdn.jsdelivr.net" - ] + script_hosts = [] csp += f"script-src 'self' 'nonce-{nonce}' " + ' '.join(script_hosts) # It's fine if css is inlined. csp += "; style-src 'self' 'unsafe-inline'" diff --git a/templates/index.html b/templates/index.html index 8cd1cc78..f8745f33 100644 --- a/templates/index.html +++ b/templates/index.html @@ -93,4 +93,14 @@
+ + + + + + + {% endblock %} diff --git a/templates/partials/head.html b/templates/partials/head.html index 0351fd6e..9b438255 100644 --- a/templates/partials/head.html +++ b/templates/partials/head.html @@ -12,5 +12,8 @@ + + +