feat: enhance security audit and CSP configuration for admin interface

2026-07-23 14:12:05 +03:30
parent 9a43dcf798
commit f218bc17ef
5 changed files with 27 additions and 9 deletions
@@ -40,9 +40,11 @@ final class AdminCspSubscriber implements EventSubscriberInterface
            . "script-src 'self'; "
            . "worker-src 'self' blob:; "            // ALTCHA proof-of-work solver runs in blob: Web Workers
            . "style-src 'self' 'unsafe-inline'; "   // Tailwind / CKEditor inline styles
-            . "img-src 'self' data: blob:; "
+            // OpenStreetMap tiles + unpkg Leaflet marker icons render the clinic-location map
+            . "img-src 'self' data: blob: https://*.tile.openstreetmap.org https://unpkg.com; "
            . "font-src 'self' data:; "
-            . "connect-src 'self'; "
+            // nominatim geocoding + OSM tile fetches for the clinic-location map
+            . "connect-src 'self' https://nominatim.openstreetmap.org https://*.tile.openstreetmap.org; "
            . "frame-ancestors 'none'; "
            . "base-uri 'self'; "
            . "object-src 'none'"