(owner: str, scope: str, target)
| 1776 | ) |
| 1777 | |
| 1778 | # CSP: tuned to keep everything working across iOS/Android/Desktop. |
| 1779 | # (We allow inline scripts for now because templates include a few inline handlers.) |
| 1780 | # If you later remove inline handlers, you can tighten script-src by removing 'unsafe-inline'. |
| 1781 | csp_value = ( |
| 1782 | "default-src 'self'; " |
| 1783 | "base-uri 'self'; " |
| 1784 | "form-action 'self'; " |
| 1785 | "frame-ancestors 'none'; " |
| 1786 | "object-src 'none'; " |
| 1787 | "img-src 'self' data: blob: https:; " |
| 1788 | "media-src 'self' blob: data:; " |
| 1789 | "font-src 'self' data: https:; " |
| 1790 | "style-src 'self' 'unsafe-inline' https://cdn.jsdelivr.net; " |
| 1791 | "script-src 'self' 'unsafe-inline' https://cdn.jsdelivr.net; " |
| 1792 | "connect-src 'self' https: wss:; " |
no test coverage detected