fix: Allow Connection to Hubspot (#633)

* fix: Allow Connection to Hubspot * moving to default-src * adding form-action
chanzuckerberg · Jul 6, 2023 · b8f9f5e · b8f9f5e
1 parent d99f066
commit b8f9f5e
Showing 1 changed file with 6 additions and 1 deletion.
diff --git a/server/ecs/app.py b/server/ecs/app.py
@@ -59,8 +59,13 @@ def _before_adding_routes(app, app_config):
 
         PLAUSIBLE_URL = "https://plausible.io"
 
+        HUBSPOT_JS_URL = "https://js.hsforms.net"
+
+        HUBSPOT_FORMS_URL = "https://forms.hsforms.com"
+
         csp = {
-            "default-src": ["'self'"],
+            "default-src": ["'self'", HUBSPOT_FORMS_URL, HUBSPOT_JS_URL],
+            "form-action": ["'self'", HUBSPOT_FORMS_URL],
             "connect-src": ["'self'", PLAUSIBLE_URL] + extra_connect_src,
             "script-src": ["'self'", "'unsafe-eval'", PLAUSIBLE_URL] + script_hashes,
             "style-src": ["'self'", "'unsafe-inline'"],