905c374e3a
Removed 'block-all-mixed-content' from Content-Security-Policy as it's deprecated and made obsolete by 'upgrade-insecure-requests' which already handles mixed content by upgrading it to HTTPS. This eliminates the Firefox console warning: "Ignoring 'block-all-mixed-content' because mixed content display upgrading makes block-all-mixed-content obsolete." Modern browsers automatically upgrade all mixed content (HTTP resources on HTTPS pages) when upgrade-insecure-requests is present, providing the same security without the deprecated directive. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com> |
||
|---|---|---|
| .. | ||
| config | ||
| controllers | ||
| middleware | ||
| models | ||
| routes | ||
| services | ||
| utils | ||
| server.js | ||