From a92ac23c445165d95aeede6a2bff74b31f47276c Mon Sep 17 00:00:00 2001
From: Danny Avila <danny@librechat.ai>
Date: Fri, 16 May 2025 09:16:32 -0400
Subject: [PATCH] =?UTF-8?q?=F0=9F=9B=A1=EF=B8=8F=20fix:=20Temporarily=20Re?=
 =?UTF-8?q?move=20CSP=20until=20Configurable=20(#7419)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 api/server/index.js | 41 +----------------------------------------
 1 file changed, 1 insertion(+), 40 deletions(-)

diff --git a/api/server/index.js b/api/server/index.js
index 3c8d3dd951..9812fa530d 100644
--- a/api/server/index.js
+++ b/api/server/index.js
@@ -2,7 +2,6 @@ require('dotenv').config();
 const path = require('path');
 require('module-alias')({ base: path.resolve(__dirname, '..') });
 const cors = require('cors');
-const helmet = require('helmet');
 const axios = require('axios');
 const express = require('express');
 const compression = require('compression');
@@ -23,15 +22,7 @@ const staticCache = require('./utils/staticCache');
 const noIndex = require('./middleware/noIndex');
 const routes = require('./routes');
 
-const {
-  PORT,
-  HOST,
-  ALLOW_SOCIAL_LOGIN,
-  DISABLE_COMPRESSION,
-  TRUST_PROXY,
-  SANDPACK_BUNDLER_URL,
-  SANDPACK_STATIC_BUNDLER_URL,
-} = process.env ?? {};
+const { PORT, HOST, ALLOW_SOCIAL_LOGIN, DISABLE_COMPRESSION, TRUST_PROXY } = process.env ?? {};
 
 const port = Number(PORT) || 3080;
 const host = HOST || 'localhost';
@@ -64,36 +55,6 @@ const startServer = async () => {
   app.use(mongoSanitize());
   app.use(cors());
   app.use(cookieParser());
-  app.use(
-    helmet({
-      contentSecurityPolicy: {
-        useDefaults: false,
-        directives: {
-          defaultSrc: ["'self'"],
-          scriptSrc: ["'self'", "'unsafe-inline'", 'https://challenges.cloudflare.com'],
-          styleSrc: ["'self'", "'unsafe-inline'"],
-          fontSrc: ["'self'", 'data:'],
-          objectSrc: ["'none'"],
-          imgSrc: ["'self'", 'data:'],
-          mediaSrc: ["'self'", 'data:', 'blob:'],
-          connectSrc: ["'self'"],
-          frameSrc: [
-            "'self'",
-            'https://challenges.cloudflare.com',
-            'https://codesandbox.io',
-            ...(SANDPACK_BUNDLER_URL ? [SANDPACK_BUNDLER_URL] : []),
-            ...(SANDPACK_STATIC_BUNDLER_URL ? [SANDPACK_STATIC_BUNDLER_URL] : []),
-          ],
-          frameAncestors: [
-            "'self'",
-            'https://codesandbox.io',
-            ...(SANDPACK_BUNDLER_URL ? [SANDPACK_BUNDLER_URL] : []),
-            ...(SANDPACK_STATIC_BUNDLER_URL ? [SANDPACK_STATIC_BUNDLER_URL] : []),
-          ],
-        },
-      },
-    }),
-  );
 
   if (!isEnabled(DISABLE_COMPRESSION)) {
     app.use(compression());