Remove CSP hole

Emyrk · Emyrk · commit 77d943f2c3bb · 2023-04-27T10:49:26.000-05:00
diff --git a/site/site.go b/site/site.go
@@ -319,8 +319,7 @@ func cspHeaders(next http.Handler) http.Handler {
 		cspSrcs := CSPDirectives{
 			// All omitted fetch csp srcs default to this.
 			CSPDirectiveDefaultSrc: {"'self'"},
-			// TODO: @emyrk fix this to only include the primary and proxy domains.
-			CSPDirectiveConnectSrc: {"'self' ws: wss:"},
+			CSPDirectiveConnectSrc: {"'self'"},
 			CSPDirectiveChildSrc:   {"'self'"},
 			// https://github.com/suren-atoyan/monaco-react/issues/168
 			CSPDirectiveScriptSrc: {"'self'"},
