From 1e78cc3dab21c3f446d19ae6ac33ed90b928b550 Mon Sep 17 00:00:00 2001 From: lebaudantoine Date: Wed, 6 May 2026 16:47:51 +0200 Subject: [PATCH] =?UTF-8?q?=E2=9C=A8(frontend)=20add=20configurable=20mini?= =?UTF-8?q?stries=20domains=20to=20add-in=20CSP?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Introduce a variable to define allowed ministries domains in the CSP configuration for the add-in. This improves flexibility and avoids hardcoding domain lists. --- docker/dinum-frontend/nginx/default.conf | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/docker/dinum-frontend/nginx/default.conf b/docker/dinum-frontend/nginx/default.conf index e5b2b71b..4e88da8d 100644 --- a/docker/dinum-frontend/nginx/default.conf +++ b/docker/dinum-frontend/nginx/default.conf @@ -45,13 +45,14 @@ server { add_header Expires 0 always; set $ms_domains "https://*.live.com https://*.office.com https://*.microsoft.com https://*.office365.com https://*.sharepoint.com https://*.cloud.microsoft"; + set $ministries_domains "https://courrieljf.ccomptes.fr"; set $nonce $request_id; set $csp "upgrade-insecure-requests; "; - set $csp "${csp}frame-ancestors ${ms_domains}; "; + set $csp "${csp}frame-ancestors ${ms_domains} ${ministries_domains}; "; set $csp "${csp}script-src 'nonce-${nonce}' 'strict-dynamic'; "; - set $csp "${csp}connect-src 'self' ${ms_domains}; "; + set $csp "${csp}connect-src 'self' ${ms_domains} ${ministries_domains}; "; set $csp "${csp}frame-src 'none'; "; set $csp "${csp}object-src 'none'; "; set $csp "${csp}base-uri 'none'; ";