fix: CSP connect-src web.archive.org, Clipboard ohne Permission-Dialog

2026-06-12 11:25:37 +02:00
parent 45ac6dd8c0
commit cc2d65c18f
2 changed files with 12 additions and 6 deletions
--- a/backend/src/index.js
+++ b/backend/src/index.js
@@ -33,7 +33,7 @@ app.use((_req, res, next) => {
    "style-src 'self' 'unsafe-inline' https://fonts.googleapis.com",
    "font-src 'self' https://fonts.gstatic.com",
    // iCal-Feeds werden serverseitig geprosxt → nur 'self' nötig
-    "connect-src 'self'",
+    "connect-src 'self' https://web.archive.org",
    // data: für Avatare (base64), google.com + gstatic.com für Favicons im QuickLinks-Widget
    "img-src 'self' data: https://www.google.com https://*.gstatic.com https://image.tmdb.org",
    "worker-src 'self'",