From 34906d636dd28dc044f9fc18687730356e67fd83 Mon Sep 17 00:00:00 2001
From: Mees Frensel <meesfrensel@gmail.com>
Date: Tue, 20 Jan 2026 14:01:46 +0100
Subject: [PATCH] feat(web): add content security policy (CSP)

---
 web/src/app.html     | 2 +-
 web/svelte.config.js | 9 +++++++++
 2 files changed, 10 insertions(+), 1 deletion(-)

diff --git a/web/src/app.html b/web/src/app.html
index 776764850f..9c2416e879 100644
--- a/web/src/app.html
+++ b/web/src/app.html
@@ -66,7 +66,7 @@
         background-color: black;
       }
     </style>
-    <script>
+    <script nonce="%sveltekit.nonce%">
       /**
        * Prevent FOUC on page load.
        */
diff --git a/web/svelte.config.js b/web/svelte.config.js
index 5daf958986..36f1dd11bf 100644
--- a/web/svelte.config.js
+++ b/web/svelte.config.js
@@ -31,6 +31,15 @@ const config = {
       $i18n: '../i18n',
       'chromecast-caf-sender': './node_modules/@types/chromecast-caf-sender/index.d.ts',
     },
+    csp: {
+      directives: {
+        'default-src': ['self'],
+        'connect-src': ['self', 'blob:', 'https://*.immich.cloud', 'https://*.maptiler.com'], // TODO: check if custom maptiler json works
+        'img-src': ['self', 'blob:', 'data:'],
+        'script-src': ['self', 'wasm-unsafe-eval', 'https://*.gstatic.com'],
+        'worker-src': ['self', 'blob:'],
+      },
+    },
   },
 };