GitHub IssueCommentEvent at 2015-01-01 16:37:26
Repository: helmetjs/helmet
Actor: EvanHahn
Payload: {"action":"created","issue":{"url":"https://api.github.com/repos/helmetjs/helmet/issues/87","labels_url":"https://api.github.com/repos/helmetjs/helmet/issues/87/labels{/name}","comments_url":"https://api.github.com/repos/helmetjs/helmet/issues/87/comments","events_url":"https://api.github.com/repos/helmetjs/helmet/issues/87/events","html_url":"https://github.com/helmetjs/helmet/issues/87","id":53112570,"number":87,"title":"How to allow Cross-Origin request to fonts.gstatic.com?","user":{"login":"binarykitchen","id":177641,"avatar_url":"https://avatars.githubusercontent.com/u/177641?v=3","gravatar_id":"","url":"https://api.github.com/users/binarykitchen","html_url":"https://github.com/binarykitchen","followers_url":"https://api.github.com/users/binarykitchen/followers","following_url":"https://api.github.com/users/binarykitchen/following{/other_user}","gists_url":"https://api.github.com/users/binarykitchen/gists{/gist_id}","starred_url":"https://api.github.com/users/binarykitchen/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/binarykitchen/subscriptions","organizations_url":"https://api.github.com/users/binarykitchen/orgs","repos_url":"https://api.github.com/users/binarykitchen/repos","events_url":"https://api.github.com/users/binarykitchen/events{/privacy}","received_events_url":"https://api.github.com/users/binarykitchen/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":3,"created_at":"2014-12-30T12:29:13Z","updated_at":"2015-01-01T16:37:26Z","closed_at":null,"body":"In Firefox I see this warning but do not know what to do:\r\n\r\n```\r\nCross-Origin Request Blocked: The Same Origin Policy disallows reading the remote resource at https://fonts.gstatic.com/s/varelaround/v6/APH4jr0uSos5wiut5cpjrnhCUOGz7vYGh680lGh-uXM.woff. This can be fixed by moving the resource to the same domain or enabling CORS.\r\n```\r\n\r\nMy current helmet code is\r\n\r\n```js\r\nvar helmet = require('helmet')\r\n\r\nmodule.exports.secure = function(app) {\r\n    var policy = {\r\n        defaultPolicy: {\r\n            'default-src': [\r\n                \"'self'\",\r\n                \"data:\",\r\n                \"'unsafe-inline'\",\r\n                \"'unsafe-eval'\"\r\n            ],\r\n            'img-src': [\r\n                \"'self'\",\r\n                \"data:\",\r\n                \"www.google-analytics.com\"\r\n            ],\r\n            'script-src': [\r\n                \"'self'\",\r\n                \"'unsafe-inline'\",\r\n                \"'unsafe-eval'\",\r\n                \"www.google-analytics.com\"\r\n            ]\r\n        }\r\n    }\r\n\r\n    app.use(helmet.csp(policy))\r\n\r\n    // Stop Clickjacking with one simple header\r\n    // but allow it for responsinator only\r\n    helmet.xframe('allow-from', 'http://www.responsinator.com')\r\n\r\n    app.use(helmet.nosniff())\r\n    app.use(helmet.xssFilter())\r\n    app.use(helmet.hidePoweredBy())\r\n\r\n    app.use(function(req, res, next) {\r\n        res.header(\"Access-Control-Allow-Origin\", \"*\")\r\n        res.header(\"Access-Control-Allow-Headers\", \"Origin, X-Requested-With, Content-Type, Accept\")\r\n\r\n        next()\r\n    })\r\n}\r\n```"},"comment":{"url":"https://api.github.com/repos/helmetjs/helmet/issues/comments/68491017","html_url":"https://github.com/helmetjs/helmet/issues/87#issuecomment-68491017","issue_url":"https://api.github.com/repos/helmetjs/helmet/issues/87","id":68491017,"user":{"login":"EvanHahn","id":777712,"avatar_url":"https://avatars.githubusercontent.com/u/777712?v=3","gravatar_id":"","url":"https://api.github.com/users/EvanHahn","html_url":"https://github.com/EvanHahn","followers_url":"https://api.github.com/users/EvanHahn/followers","following_url":"https://api.github.com/users/EvanHahn/following{/other_user}","gists_url":"https://api.github.com/users/EvanHahn/gists{/gist_id}","starred_url":"https://api.github.com/users/EvanHahn/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/EvanHahn/subscriptions","organizations_url":"https://api.github.com/users/EvanHahn/orgs","repos_url":"https://api.github.com/users/EvanHahn/repos","events_url":"https://api.github.com/users/EvanHahn/events{/privacy}","received_events_url":"https://api.github.com/users/EvanHahn/received_events","type":"User","site_admin":false},"created_at":"2015-01-01T16:37:26Z","updated_at":"2015-01-01T16:37:26Z","body":"Try \"flattening\" your CSP policy, to something more like this:\r\n\r\n```js\r\nvar policy = {\r\n  'default-src': [ /* ... */ ],\r\n  // ...\r\n}\r\n```"}}