From cf1950f31a0c868bcfd9c6ddef1b6d315cd623b8 Mon Sep 17 00:00:00 2001
From: mbecker20 <becker.maxh@gmail.com>
Date: Fri, 15 Apr 2022 03:26:21 -0700
Subject: [PATCH] connect-src security directive for websockets

---
 core/src/main.ts | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/core/src/main.ts b/core/src/main.ts
index b208444e0..13be751cb 100644
--- a/core/src/main.ts
+++ b/core/src/main.ts
@@ -1,7 +1,7 @@
 import fastify from "fastify";
 import fastifyCors from "fastify-cors";
 import fastifyHelmet from "fastify-helmet";
-import { LOGGER, PORT } from "./config";
+import { HOST, LOGGER, PORT } from "./config";
 import auth from "./plugins/auth";
 import db from "./plugins/db";
 import ws from "./plugins/ws";
@@ -17,6 +17,9 @@ async function main() {
         useDefaults: true,
         directives: {
           "img-src": ["'self'", "https: data:"],
+          "connect-src": [
+            HOST.replace("https", "wss").replace("http", "ws") + "/ws",
+          ],
         },
       },
     })