yakuza0 2.22.29 → 2.22.30-beta.1

package/nuxt/render/csp.js

@@ -20,8 +20,8 @@ exports.default = function (config) {
     cspSwitch = false;
   }
 
+  directives['script-src'] = _yakuza._.difference(directives['script-src'], ["'self'", '"self"']);
   if (_config2.default.security.isStupid) {
-    directives['script-src'] = _yakuza._.difference(directives['script-src'], ["'self'"]);
     if (!(directives['object-src'] && _yakuza._.isArray(directives['object-src']) && directives['object-src'].length > 0)) {
       directives['object-src'] = ["'none'"];
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "yakuza0",
-  "version": "2.22.29",
+  "version": "2.22.30-beta.1",
   "description": "yakuza0 with nuxt",
   "main": "index.js",
   "scripts": {

package/server/proxy/csrf.js

@@ -274,12 +274,24 @@ exports.default = function () {
                 // referrerPolicy: { policy: "strict-origin-when-cross-origin" },
                 // referrerPolicy: yConf.stupid.referrerPolicy.policy,
                 // referrerPolicy: { policy: "origin-when-crossorigin" },
-                referrerPolicy: _config2.default.server.stupid.referrerPolicy
-                // if (yConf.security.isStupid && yConf.security.isDev) {
-                //   helmetOptions.referrerPolicy = yConf.server.stupid.referrerPolicy;
-                // }
-
+                // referrerPolicy: yConf.server.stupid.referrerPolicy,
+                crossOriginResourcePolicy: _config2.default.server.hm.crossOriginEmbedderPolicy
+                // crossOriginEmbedderPolicy: true,
+                // crossOriginResourcePolicy: { policy: "cross-origin" },
+                // crossOriginResourcePolicy: { policy: "same-origin" }
               };
+
+
+              if (!_config2.default.server.hm.crossOriginEmbedderPolicy) {
+                helmetOptions.crossOriginEmbedderPolicy = { policy: "credentialless" };
+                // helmetOptions.crossOriginResourcePolicy = { policy: "cross-origin" };
+              }
+
+              if (_config2.default.security.isStupid) {
+                // helmetOptions.referrerPolicy = yConf.server.stupid.referrerPolicy;
+                // helmetOptions.crossOriginResourcePolicy = yConf.server.stupid.crossOriginResourcePolicy;
+              }
+
               app.use((0, _koaHelmet2.default)(helmetOptions));
             }
 

package/utils/inclusive.js

@@ -313,6 +313,9 @@ var render = function () {
                 cookieSameSite: 'Lax',
                 // ...mainConf.server,
                 // ...ykConf.server,
+                hm: {
+                  crossOriginEmbedderPolicy: true
+                },
                 log: {
                   enabled: true,
                   onlySSR: true,
@@ -509,7 +512,8 @@ var render = function () {
                   }
                 },
                 stupid: {
-                  referrerPolicy: { policy: "strict-origin-when-cross-origin" }
+                  referrerPolicy: { policy: "strict-origin-when-cross-origin" },
+                  crossOriginResourcePolicy: { policy: "same-origin" }
                 }
               },
               extend: {