From c030db4f89c18bd0fc517cc8d06e4ce39bb0d3cd Mon Sep 17 00:00:00 2001
From: Nguyen-The-Lap <91041708+Nguyen-The-Lap@users.noreply.github.com>
Date: Tue, 16 Dec 2025 15:29:55 +0700
Subject: [PATCH] Add Content Security Policy to index.html

Added Content Security Policy meta tag to enhance security against XSS and Ddosing.
---
 public/index.html | 13 ++++++++++++-
 1 file changed, 12 insertions(+), 1 deletion(-)

diff --git a/public/index.html b/public/index.html
index c4e2378..b6c9bb2 100644
--- a/public/index.html
+++ b/public/index.html
@@ -12,6 +12,17 @@
     <meta name="HandheldFriendly" content="true" />
     <meta http-equiv="X-UA-Compatible" content="IE=edge" />
     <meta name="format-detection" content="telephone=no" />
+    <meta http-equiv="Content-Security-Policy"
+        content="default-src 'self';
+                 script-src 'self';
+                 style-src 'self' https://fonts.googleapis.com;
+                 font-src 'self' https://fonts.gstatic.com;
+                 img-src 'self' data: https:;
+                 connect-src 'self';
+                 object-src 'none';
+                 frame-ancestors 'none';
+                 base-uri 'self';">
+  <meta name="referrer" content="strict-origin-when-cross-origin">
     
     <link rel="apple-touch-icon" href="%PUBLIC_URL%/logo192.png" />
     <link rel="manifest" href="%PUBLIC_URL%/manifest.json" />
@@ -40,4 +51,4 @@
     <noscript>You need to enable JavaScript to run this app.</noscript>
     <div id="root"></div>
   </body>
-</html>
\ No newline at end of file
+</html>