diff --git a/app/Util/CspService.php b/app/Util/CspService.php index ba927c93b..f9ab666ac 100644 --- a/app/Util/CspService.php +++ b/app/Util/CspService.php @@ -22,7 +22,7 @@ class CspService } /** - * Get the CSP headers for the application + * Get the CSP headers for the application. */ public function getCspHeader(): string { @@ -86,6 +86,7 @@ class CspService { $iframeHosts = $this->getAllowedIframeHosts(); array_unshift($iframeHosts, "'self'"); + return 'frame-ancestors ' . implode(' ', $iframeHosts); } @@ -97,6 +98,7 @@ class CspService { $iframeHosts = $this->getAllowedIframeSources(); array_unshift($iframeHosts, "'self'"); + return 'frame-src ' . implode(' ', $iframeHosts); } diff --git a/tests/SecurityHeaderTest.php b/tests/SecurityHeaderTest.php index 1a0a6c9b3..d8ba5873f 100644 --- a/tests/SecurityHeaderTest.php +++ b/tests/SecurityHeaderTest.php @@ -130,7 +130,7 @@ class SecurityHeaderTest extends TestCase { config()->set([ 'app.iframe_sources' => 'https://example.com', - 'services.drawio' => 'https://diagrams.example.com/testing?cat=dog', + 'services.drawio' => 'https://diagrams.example.com/testing?cat=dog', ]); $resp = $this->get('/');