Repository navigation
Conversation
The policy allows scripts by origin (self, Google Tag Manager) and by hash for the five inline scripts Starlight writes in every page, styles inline (Expressive Code writes style attributes hashes cannot cover), YouTube's nocookie embed in frames and Google Analytics 4 for images and connections. 'unsafe-eval' is there for Alpine.js, 'wasm-unsafe-eval' for Pagefind. The site's own scripts no longer sit inline in the page: the analytics and consent scripts are processed by Astro (the GTM id moves to src/data/analytics.ts), the homepage's terminal sequence becomes a JSON data block, the changelog filter's inline onsubmit an addEventListener, and assetsInlineLimit is 0 so Astro emits scripts as files. scripts/check-csp.mjs runs after the build and fails when an inline script is not covered by a hash of the policy, or when a page has an inline event handler: a Starlight upgrade would otherwise break the site without a word.
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
The homepage video asks for its thumbnail on i.ytimg.com: add it to img-src. CLAUDE.md now says where the headers live, how to allow a new service, what check-csp guards and which concessions the policy makes.
This branch was successfully deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
Step 2 of
.claude/plans/security-headers.md(Aikido: CSP not set). Report-only: nothing is blocked, violations show in the browser console.What
vercel.json: aContent-Security-Policy-Report-Onlyheader. Scripts by origin ('self', Google Tag Manager) and by hash for Starlight's five inline scripts; styles inline (Expressive Code writesstyleattributes); YouTube's nocookie embed in frames; Google Analytics 4 for images and connections;'unsafe-eval'for Alpine.js,'wasm-unsafe-eval'for Pagefind.src/data/analytics.ts), the homepage terminal sequence is a JSON data block, the changelog filter'sonsubmitis anaddEventListener,assetsInlineLimit: 0makes Astro emit scripts as files.scripts/check-csp.mjs(postbuild) fails when an inline script is not covered by a hash of the policy or a page has an inline event handler, so a Starlight upgrade cannot break the site silently.Astro's own
security.cspwas tried and dropped: it hashes styles too, which makesstyleattributes (398 on a doc page) impossible, and it is a<meta>tag, so never report-only.Next
Browse the preview with the console open, fix what it reports, then a last PR turns the header into an enforced
Content-Security-Policy.