nit: Updated old index.html CSP

tebanieo · tebanieo · commit 278708e68f92 · 2025-08-20T16:04:39.000-04:00
diff --git a/workshops/modernizr/clean-start/frontend/public/index.html b/workshops/modernizr/clean-start/frontend/public/index.html
@@ -3,22 +3,11 @@
   <head>
     <meta charset="utf-8" />
     <link rel="icon" href="%PUBLIC_URL%/favicon.ico" />
-    <meta name="viewport" content="width=device-width, initial-scale=1" />
+    <meta name="viewport" content="default-src 'self'; upgrade-insecure-requests; script-src 'self'; style-src 'self'; img-src 'self' data: https:; font-src 'self' data:; connect-src 'self' https:; media-src 'self'; object-src 'none'; child-src 'none'; frame-ancestors 'none'; base-uri 'self'; form-action 'self';" />
     
-    <!-- Security Headers - Development-friendly CSP -->
+    <!-- Security Headers - Environment-based CSP -->
     <meta http-equiv="Content-Security-Policy" 
-          content="default-src 'self'; 
-                   script-src 'self' 'unsafe-inline' 'unsafe-eval'; 
-                   style-src 'self' 'unsafe-inline'; 
-                   img-src 'self' data: https: blob:; 
-                   font-src 'self' data:; 
-                   connect-src 'self' http://localhost:* ws://localhost:* wss://localhost:*; 
-                   media-src 'self'; 
-                   object-src 'none'; 
-                   child-src 'none'; 
-                   frame-ancestors 'none'; 
-                   base-uri 'self'; 
-                   form-action 'self';">
+          content="default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline'; img-src 'self' data: https: blob:; font-src 'self' data:; connect-src 'self' http://localhost:* ws://localhost:* wss://localhost:*; media-src 'self'; object-src 'none'; child-src 'none'; frame-ancestors 'none'; base-uri 'self'; form-action 'self';">
     <meta http-equiv="X-Frame-Options" content="DENY">
     <meta http-equiv="X-Content-Type-Options" content="nosniff">
     <meta http-equiv="X-XSS-Protection" content="1; mode=block">
