Fix: CSP expanded to allow Google Fonts and jsdelivr CDN used by admin SPA

app/middleware/security_headers.py

@@ -34,9 +34,13 @@ class SecurityHeadersMiddleware:
                     (b"permissions-policy", b"camera=(), microphone=(), geolocation=(), payment=()"),
                     # R-043: CSP — primary XSS defense
                     (b"content-security-policy",
-                     b"default-src 'self'; script-src 'self' 'unsafe-inline'; "
-                     b"style-src 'self' 'unsafe-inline'; img-src 'self' data: https:; "
-                     b"connect-src 'self' https://api.openai.com; frame-ancestors 'none'"),
+                     b"default-src 'self'; "
+                     b"script-src 'self' 'unsafe-inline' https://cdn.jsdelivr.net; "
+                     b"style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; "
+                     b"font-src 'self' https://fonts.gstatic.com; "
+                     b"img-src 'self' data: https:; "
+                     b"connect-src 'self' https://api.openai.com; "
+                     b"frame-ancestors 'none'"),
                 ]
                 if use_hsts:
                     security_headers.insert(