Use x-forwarded-host first to fill connect-src
Ylian Saint-Hilaire committed
Nov 28, 2020 at 18:55 UTC
4f4d20649a76727df9b8307a1802c4910232078a
1 file changed
+1
-1
webserver.js
+1
-1
@@ -4888,7 +4888,7 @@ module.exports.CreateWebServer = function (parent, db, args, certificates) {
4888
} else {
4889
// Use default security headers
4890
var geourl = (domain.geolocation ? ' *.openstreetmap.org' : '');
4891
- var selfurl = (' wss://' + req.headers.host);
4891
+ var selfurl = req.headers['x-forwarded-host'] ? (' wss://' + req.headers['x-forwarded-host']) : (' wss://' + req.headers.host);
4892
var headers = {
4893
'Referrer-Policy': 'no-referrer',
4894
'X-XSS-Protection': '1; mode=block',