480ceb5e08
Having both a Content-Security-Policy (CSP) in meta tag and per header works fine together. They are merged and the strongest one is applied. It makes Croodle safer for all users even if the hoster does not apply CSP for some reason (e.g. they can't set custom headers). It's still a good idea to recommend using a CSP header cause that ones are applied earlier - even so this shouldn't be a problem cause we ensure that CSP meta tag is present before any other link, style or script element.
75 lines
1.7 KiB
JavaScript
75 lines
1.7 KiB
JavaScript
'use strict';
|
|
|
|
module.exports = function(environment) {
|
|
let ENV = {
|
|
modulePrefix: 'croodle',
|
|
environment,
|
|
rootURL: '/',
|
|
locationType: 'hash',
|
|
EmberENV: {
|
|
FEATURES: {
|
|
// Here you can enable experimental features on an ember canary build
|
|
// e.g. 'with-controller': true
|
|
},
|
|
EXTEND_PROTOTYPES: {
|
|
Array: true,
|
|
Date: false,
|
|
String: false,
|
|
Function: true
|
|
}
|
|
},
|
|
|
|
APP: {
|
|
// Here you can pass flags/options to your application instance
|
|
// when it is created
|
|
},
|
|
|
|
contentSecurityPolicy: {
|
|
'default-src': "'none'",
|
|
'script-src': "'self'",
|
|
'font-src': "'self'",
|
|
'connect-src': "'self'",
|
|
'img-src': "'none'",
|
|
'style-src': "'self'",
|
|
'media-src': "'none'",
|
|
},
|
|
contentSecurityPolicyMeta: true,
|
|
|
|
moment: {
|
|
includeLocales: ['ca', 'de', 'en-gb', 'es', 'it'],
|
|
includeTimezone: 'subset'
|
|
},
|
|
|
|
i18n: {
|
|
defaultLocale: 'en'
|
|
}
|
|
};
|
|
|
|
if (environment === 'development') {
|
|
// ENV.APP.LOG_RESOLVER = true;
|
|
// ENV.APP.LOG_ACTIVE_GENERATION = true;
|
|
// ENV.APP.LOG_TRANSITIONS = true;
|
|
// ENV.APP.LOG_TRANSITIONS_INTERNAL = true;
|
|
// ENV.APP.LOG_VIEW_LOOKUPS = true;
|
|
}
|
|
|
|
if (environment === 'test') {
|
|
ENV.rootURL = '/';
|
|
|
|
// Testem prefers this...
|
|
ENV.locationType = 'none';
|
|
|
|
// keep test console output quieter
|
|
ENV.APP.LOG_ACTIVE_GENERATION = false;
|
|
ENV.APP.LOG_VIEW_LOOKUPS = false;
|
|
|
|
ENV.APP.rootElement = '#ember-testing';
|
|
ENV.APP.autoboot = false;
|
|
}
|
|
|
|
if (environment === 'production') {
|
|
// here you can enable a production-specific feature
|
|
}
|
|
|
|
return ENV;
|
|
};
|