Fix #116: allow inline styles in CSP (style-src 'self' 'unsafe-inline')

2026-09-09 21:18:53 -05:00
parent 9ec7d5152e
commit 073d39ccba
2 changed files with 2 additions and 2 deletions
@@ -344,7 +344,7 @@ func SecurityHeaders(next http.Handler) http.Handler {
 		// is harmless and arguably desirable.
 		h := w.Header()
 		h.Set("Content-Security-Policy",
-			"default-src 'self'; script-src 'self' 'unsafe-inline'; frame-ancestors 'none'")
+			"default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; frame-ancestors 'none'")
 		h.Set("Referrer-Policy", "no-referrer")
 		h.Set("X-Content-Type-Options", "nosniff")
 		next.ServeHTTP(w, r)