From 53722ad1bc2a35fe51d55514a602cb090583b669 Mon Sep 17 00:00:00 2001
From: lebaudantoine <lebaud.antoine131@gmail.com>
Date: Fri, 12 Jun 2026 15:47:55 +0200
Subject: [PATCH] =?UTF-8?q?=F0=9F=A9=B9(frontend)=20fix=20CSP=20regression?=
 =?UTF-8?q?=20breaking=20inline=20styles=20and=20ProConnect?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

A previous CSP change suggested by CodeRabbit was not properly
tested and broke inline styling as well as the loading of the
ProConnect image.

Adjust the CSP directives to allow these resources again.
---
 docker/dinum-frontend/nginx/default.conf        | 3 +++
 src/helm/extra/templates/frontend_nginx_cm.yaml | 3 +++
 2 files changed, 6 insertions(+)

diff --git a/docker/dinum-frontend/nginx/default.conf b/docker/dinum-frontend/nginx/default.conf
index 76619fb9..173f5b9f 100644
--- a/docker/dinum-frontend/nginx/default.conf
+++ b/docker/dinum-frontend/nginx/default.conf
@@ -51,6 +51,9 @@ server {
       set $csp "default-src 'self'; upgrade-insecure-requests; ";
       set $csp "${csp}frame-ancestors ${ms_domains}; ";
       set $csp "${csp}script-src 'nonce-${nonce}' 'strict-dynamic'; ";
+      set $csp "${csp}style-src 'self' 'unsafe-inline'; ";
+      set $csp "${csp}img-src 'self' data:; ";
+      set $csp "${csp}font-src 'self' data:; ";
       set $csp "${csp}connect-src 'self' ${ms_domains}; ";
       set $csp "${csp}frame-src 'none'; ";
       set $csp "${csp}object-src 'none'; ";
diff --git a/src/helm/extra/templates/frontend_nginx_cm.yaml b/src/helm/extra/templates/frontend_nginx_cm.yaml
index ede7cd6e..fffddf3b 100644
--- a/src/helm/extra/templates/frontend_nginx_cm.yaml
+++ b/src/helm/extra/templates/frontend_nginx_cm.yaml
@@ -59,6 +59,9 @@ data:
             set $csp "default-src 'self'; upgrade-insecure-requests; ";
             set $csp "${csp}frame-ancestors ${ms_domains}; ";
             set $csp "${csp}script-src 'nonce-${nonce}' 'strict-dynamic'; ";
+            set $csp "${csp}style-src 'self' 'unsafe-inline'; ";
+            set $csp "${csp}img-src 'self' data:; ";
+            set $csp "${csp}font-src 'self' data:; ";
             set $csp "${csp}connect-src 'self' ${ms_domains}; ";
             set $csp "${csp}frame-src 'none'; ";
             set $csp "${csp}object-src 'none'; ";