Legger til cdn.nav.no i CSP-whitelist, umami sitt sporingsscript ligger der

Author: hanneolsen

Diff for: packages/familie-backend/src/headers.ts

@@ -7,8 +7,9 @@ const amplitude = 'https://amplitude.nav.no';
 const sentry = 'https://sentry.gc.nav.no';
 const navTelemetry = 'https://telemetry.nav.no';
 const navTelemetryDev = 'https://telemetry.ekstern.dev.nav.no';
+const navCdn = 'https://cdn.nav.no';
 
-const cspString = `default-src 'self' data: ${amplitude} ${sentry} ${navTelemetry} ${navTelemetryDev}; style-src 'self' ${styleSource} data: 'unsafe-inline'; font-src 'self' ${fontSource} ${navFontSource} data:; frame-src 'self' blob:;`;
+const cspString = `default-src 'self' data: ${amplitude} ${sentry} ${navTelemetry} ${navTelemetryDev} ${navCdn}; style-src 'self' ${styleSource} data: 'unsafe-inline'; font-src 'self' ${fontSource} ${navFontSource} data:; frame-src 'self' blob:;`;
 
 const setup = (app: Express) => {
     app.disable('x-powered-by');