From 3e6c692cf4886bccb90e4a1d39d47e1ec07b46e5 Mon Sep 17 00:00:00 2001
From: martines3000 <domajnko.martin@gmail.com>
Date: Wed, 27 Nov 2024 13:38:47 +0100
Subject: [PATCH] chore: add connect-src domains

---
 apps/frontend/next.config.js | 30 ++++++++++++++++++++++++++++--
 1 file changed, 28 insertions(+), 2 deletions(-)

diff --git a/apps/frontend/next.config.js b/apps/frontend/next.config.js
index dc1f48af..a7785c1f 100644
--- a/apps/frontend/next.config.js
+++ b/apps/frontend/next.config.js
@@ -1,9 +1,35 @@
 // @ts-check
 
+const CONNECT_DOMAINS = [
+  // CDN
+  'https://static.swaylend.com',
+  'https://testnet-swaylend.b-cdn.net',
+  // Swaylend API
+  'https://testnet-api.swaylend.com',
+  'https://api.swaylend.com',
+  // Fuel
+  'https://testnet.fuel.network',
+  'https://mainnet.fuel.network',
+  // Outside domains
+  'https://api.web3modal.org',
+  'https://api.bako.global',
+  'wss://relay.walletconnect.com',
+  // PostHog
+  'https://eu.i.posthog.com',
+  // Sentio
+  'https://app.sentio.xyz',
+  // Hermes
+  'https://gateway-lon.liquify.com',
+  'https://hermes.pyth.network',
+  // OpenBlock
+  'https://www.data-openblocklabs.com',
+];
+
 const CSP_HEADER = `
-    default-src 'self' https://static.swaylend.com https://testnet-swaylend.b-cdn.net;
+    default-src 'self';
+    connect-src 'self' https://app.swaylend.com ${CONNECT_DOMAINS.join(' ')};
     script-src 'self' 'unsafe-eval' 'unsafe-inline' https://vercel.live https://static.swaylend.com https://testnet-swaylend.b-cdn.net;
-    style-src 'self' 'unsafe-inline' https://static.swaylend.com https://testnet-swaylend.b-cdn.net;
+    style-src 'self' 'unsafe-inline' https://static.swaylend.com https://testnet-swaylend.b-cdn.net https://fonts.googleapis.com;
     img-src 'self' blob: data: https://static.swaylend.com https://testnet-swaylend.b-cdn.net;
     font-src 'self' https://fonts.googleapis.com https://static.swaylend.com https://testnet-swaylend.b-cdn.net;
     object-src 'none';