fix: csp header changed placement

[LauraWitulskiMorales]

No description provided.

[LauraWitulskiMorales]

Fixes placement issue from #384

[LauraWitulskiMorales]

Ticket reference

[timbru31]

Loading the image 'data:image/svg+xml;base64,....' violates the following Content Security Policy directive: "img-src 'self' https://api.dicebear.com https://wiki.sinnerschrader.com/rest/cas/1.0/avatar/server/ https://s2-staging-lara-avatar-bucket.s3.eu-central-1.amazonaws.com". The action has been blocked.

I think we need to add data: for img-src, too

[timbru31]

use-token-refresh-link.ts:34 Connecting to 'https://api.staging.lara.sinnerschrader.com/backend/oauth/token' violates the following Content Security Policy directive: "connect-src 'self' https://api.staging.lara.sinnerschrader.com/backend https://login.microsoftonline.com". The action has been blocked.

--> I think we actually need to get the https://api.staging.lara.sinnerschrader.com/ URL. it seems like BACKEND_URL_WITHOUT_HTTPS is with /backend 👎

[timbru31]

We could introduce "BACKEND_DOMAIN_NAME" and set it like here:

lara/.github/workflows/reusable-deploy-job.yml

Line 88 in 706a6e4

echo "BACKEND_URL_WITHOUT_HTTPS=$(echo ${{ secrets.BACKEND_URL }} | sed 's/^https:\/\///')" >> $GITHUB_ENV

-->

echo "BACKEND_DOMAIN_NAME=$(echo ${{ secrets.BACKEND_URL }} | sed 's/\backend//')" >> $GITHUB_ENV

(Also make sure to add it to the .env.example)