From fc4f7472d1135c9d4fb91e1ee46c39d9790f35b4 Mon Sep 17 00:00:00 2001 From: dev Date: Fri, 30 Oct 2026 03:22:50 +0000 Subject: [PATCH] Update app.py --- app.py | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/app.py b/app.py index 1b17ee5..a0cb53a 100644 --- a/app.py +++ b/app.py @@ -995,6 +995,9 @@ def add_security_headers(response): response.headers["Permissions-Policy"] = "camera=(self), microphone=(self), geolocation=()" response.headers["Cross-Origin-Opener-Policy"] = "same-origin" response.headers["Cross-Origin-Resource-Policy"] = "same-origin" + calls_connect_origin = CALLS_BASE + calls_ws_origin = CALLS_BASE.replace("https://", "wss://").replace("http://", "ws://") + response.headers["Content-Security-Policy"] = ( "default-src 'self'; " "base-uri 'self'; " @@ -1005,7 +1008,7 @@ def add_security_headers(response): "media-src 'self' blob:; " "style-src 'self' 'unsafe-inline'; " "script-src 'self'; " - "connect-src 'self';" + f"connect-src 'self' {calls_connect_origin} {calls_ws_origin};" ) if request.path.startswith("/static/"): response.headers["Cache-Control"] = "public, max-age=31536000, immutable"