whitelist the akamaihd.net url that Facebook uses to host profile images

2015-01-01 00:51:52 -08:00 · 2015-01-01 00:51:52 -08:00 · f82a86ca93
parent 1660097544
commit f82a86ca93
1 changed files with 2 additions and 1 deletions
--- a/app.js
+++ b/app.js
@ -137,12 +137,13 @@ app.use(helmet.contentSecurityPolicy({
    styleSrc: trusted,
    imgSrc: [
      '*.evernote.com',
-      '*.facebook.com',
      '*.amazonaws.com',
      'data:',
      '*.licdn.com',
      '*.gravatar.com',
      '*.youtube.com',
+      '*.akamaihd.net',
+      'graph.facebook.com',
      '*.githubusercontent.com',
      '*.googleusercontent.com',
    ].concat(trusted),