feat: update security headers and improve content security policy; enhance hero image component and loading states in public news

2026-05-31 14:19:15 +02:00
parent 6983186caf
commit bf1caefde4
9 changed files with 99 additions and 31 deletions
--- a/server/middleware/security-headers.js
+++ b/server/middleware/security-headers.js
@@ -38,9 +38,8 @@ export default defineEventHandler((event) => {
        "base-uri 'self'",
        "object-src 'none'",
        `frame-ancestors ${allowedFrameAncestors}`,
-        // Nuxt lädt Fonts ggf. von Google (siehe nuxt.config.js)
-        "font-src 'self' https://fonts.gstatic.com data:",
-        "style-src 'self' 'unsafe-inline' https://fonts.googleapis.com",
+        "font-src 'self' data:",
+        "style-src 'self' 'unsafe-inline'",
        // Script: Nuxt kann in Dev eval nutzen; diese CSP ist primär für Produktion gedacht.
        "script-src 'self'",
        "img-src 'self' data: blob:",