DSS-1154 Added csp header

Author: Sai Krishna Metpalli

frontend/nginx.conf

@@ -81,7 +81,7 @@ http {
         # See https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP
         # See https://content-security-policy.com/nonce/
         # See https://angular.io/guide/security#content-security-policy
-        add_header content-security-policy "default-src 'self'; style-src 'self' 'nonce-$cspNonce' ; script-src 'self' 'nonce-$cspNonce'; font-src 'self'; frame-src loginproxy.gov.bc.ca dev.loginproxy.gov.bc.ca test.loginproxy.gov.bc.ca; connect-src 'self' loginproxy.gov.bc.ca dev.loginproxy.gov.bc.ca test.loginproxy.gov.bc.ca server.arcgisonline.com; img-src 'self' https://tile.openstreetmap.org data: server.arcgisonline.com www.w3.org; frame-ancestors https://loginproxy.gov.bc.ca https://dev.loginproxy.gov.bc.ca https://test.loginproxy.gov.bc.ca; object-src 'none'; base-uri 'self'; form-action 'self';";
+        add_header content-security-policy "default-src 'self'; style-src 'self' 'nonce-$cspNonce' 'unsafe-hashes'; script-src 'self' 'nonce-$cspNonce' 'unsafe-eval'; font-src 'self'; frame-src 'self' https://loginproxy.gov.bc.ca https://dev.loginproxy.gov.bc.ca https://test.loginproxy.gov.bc.ca; connect-src 'self' ws: wss: https://loginproxy.gov.bc.ca https://dev.loginproxy.gov.bc.ca https://test.loginproxy.gov.bc.ca server.arcgisonline.com; img-src 'self' https://tile.openstreetmap.org data: server.arcgisonline.com www.w3.org; frame-ancestors https://loginproxy.gov.bc.ca https://dev.loginproxy.gov.bc.ca https://test.loginproxy.gov.bc.ca; object-src 'none'; base-uri 'self'; form-action 'self';";
 
         include /nginx/nginx.conf;
 

frontend/nginx.local.conf

@@ -79,7 +79,7 @@ http {
         # See https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP
         # See https://content-security-policy.com/nonce/
         # See https://angular.io/guide/security#content-security-policy
-        add_header content-security-policy "default-src 'self'; style-src 'self' 'nonce-$cspNonce' ; script-src 'self' 'nonce-$cspNonce'; font-src 'self'; frame-src loginproxy.gov.bc.ca dev.loginproxy.gov.bc.ca test.loginproxy.gov.bc.ca; connect-src 'self' loginproxy.gov.bc.ca dev.loginproxy.gov.bc.ca test.loginproxy.gov.bc.ca server.arcgisonline.com; img-src 'self' https://tile.openstreetmap.org data: server.arcgisonline.com www.w3.org; frame-ancestors https://loginproxy.gov.bc.ca https://dev.loginproxy.gov.bc.ca https://test.loginproxy.gov.bc.ca; object-src 'none'; base-uri 'self'; form-action 'self';";
+        add_header content-security-policy "default-src 'self'; style-src 'self' 'nonce-$cspNonce' 'unsafe-hashes'; script-src 'self' 'nonce-$cspNonce' 'unsafe-eval'; font-src 'self'; frame-src 'self' https://loginproxy.gov.bc.ca https://dev.loginproxy.gov.bc.ca https://test.loginproxy.gov.bc.ca; connect-src 'self' ws: wss: https://loginproxy.gov.bc.ca https://dev.loginproxy.gov.bc.ca https://test.loginproxy.gov.bc.ca server.arcgisonline.com; img-src 'self' https://tile.openstreetmap.org data: server.arcgisonline.com www.w3.org; frame-ancestors https://loginproxy.gov.bc.ca https://dev.loginproxy.gov.bc.ca https://test.loginproxy.gov.bc.ca; object-src 'none'; base-uri 'self'; form-action 'self';";
 
         include /nginx/nginx.conf;