fix: allow script injection from react dev tools in dev and stage envs (#6120)

2023-11-09 10:40:04 +05:30
parent 71c4c88bbe
commit a7dd5c6798
3 changed files with 19 additions and 1 deletions
--- a/server/services/web.ts
+++ b/server/services/web.ts
@@ -104,7 +104,12 @@ export default function init(app: Koa = new Koa(), server?: Server) {
      directives: {
        defaultSrc,
        styleSrc,
-        scriptSrc: [...scriptSrc, `'nonce-${ctx.state.cspNonce}'`],
+        scriptSrc: [
+          ...scriptSrc,
+          env.DEVELOPMENT_UNSAFE_INLINE_CSP
+            ? "'unsafe-inline'"
+            : `'nonce-${ctx.state.cspNonce}'`,
+        ],
        mediaSrc: ["*", "data:", "blob:"],
        imgSrc: ["*", "data:", "blob:"],
        frameSrc: ["*", "data:"],