feat: add tile server URL to CSP (#2344)

mbta · Jan 24, 2025 · abbe797 · abbe797
1 parent 4bde6d7
commit abbe797
Showing 1 changed file with 2 additions and 0 deletions.
diff --git a/lib/dotcom_web/plugs/secure_headers.ex b/lib/dotcom_web/plugs/secure_headers.ex
@@ -4,13 +4,15 @@ defmodule DotcomWeb.Plugs.SecureHeaders do
   content security policy directives at funtime.
   """
 
+  @tile_url Application.compile_env!(:dotcom, :tile_server_url)
   @base_csp_directives %{
     connect: ~w[
       connect-src
       'self'
       *.arcgis.com
       *.googleapis.com
       *.s3.amazonaws.com
+      #{@tile_url}
       analytics.google.com
       cdn.mbta.com
       px.ads.linkedin.com