From 1a932de925852cd008071f46cee95aab3d21a6a4 Mon Sep 17 00:00:00 2001 From: Kyle Spearrin Date: Fri, 18 Jan 2019 22:04:10 -0500 Subject: [PATCH] no longer need hibp in connect csp --- util/Setup/NginxConfigBuilder.cs | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/util/Setup/NginxConfigBuilder.cs b/util/Setup/NginxConfigBuilder.cs index dd9940357..88edc27d0 100644 --- a/util/Setup/NginxConfigBuilder.cs +++ b/util/Setup/NginxConfigBuilder.cs @@ -10,7 +10,7 @@ namespace Bit.Setup "default-src 'self'; style-src 'self' 'unsafe-inline'; " + "img-src 'self' data: https://haveibeenpwned.com https://www.gravatar.com; " + "child-src 'self' https://*.duosecurity.com; frame-src 'self' https://*.duosecurity.com; " + - "connect-src 'self' wss://{0} https://haveibeenpwned.com https://api.pwnedpasswords.com " + + "connect-src 'self' wss://{0} https://api.pwnedpasswords.com " + "https://twofactorauth.org; " + "object-src 'self' blob:;";