perf: 安全头配置

ncac/package/cac.conf

@@ -4,7 +4,15 @@ server {
     # 安全头配置
     add_header X-Content-Type-Options "nosniff" always;
     add_header X-XSS-Protection "1; mode=block" always;
-    add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline'; img-src 'self' data:; style-src 'self' 'unsafe-inline'; font-src 'self'; frame-ancestors 'none';" always;
+    add_header Content-Security-Policy
+        "default-src 'self';
+         connect-src 'self' data:;
+         script-src 'self' 'unsafe-inline' 'unsafe-eval';
+         worker-src 'self' blob:;
+         img-src 'self' data:;
+         style-src 'self' 'unsafe-inline';
+         font-src 'self';
+         frame-ancestors 'none';" always;
     add_header X-Frame-Options "SAMEORIGIN" always;
     proxy_set_header Upgrade $http_upgrade;
     proxy_set_header Connection "upgrade";