justin/k5bss.com
1
0 Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Fix CSP blocking Cloudflare Insights beacon and inline scripts

Browse Source 
index.html carried two Content-Security-Policy meta tags that were
never reconciled, so browsers enforced their intersection: the
Cloudflare beacon script/connect endpoints, the profile photo from
ki5bhv.com, and the page's own inline script/onerror handler all got
silently blocked depending on which policy line was checked.

Collapse index.html down to a single correct policy, and add the
same static.cloudflareinsights.com / cloudflareinsights.com
allowances to _headers (the actual Cloudflare Pages response header)
and to k5bss.html's policy, since Cloudflare injects that beacon
site-wide.

Co-Authored-By: Claude Sonnet 5 <[email protected]>
This commit is contained in:
JustinandClaude Sonnet 5 committed 2026-08-31 14:13:19 -05:00
1 parent 435f56e0cc
commit f45dfaa232
3 files changed
+3 -4
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

_headers
+1 -1
View File
@@ -1,5 +1,5 @@
/*
Content-Security-Policy: default-src 'self'; script-src 'self'; style-src 'self' https://fonts.googleapis.com 'unsafe-inline'; font-src 'self' https://fonts.gstatic.com; img-src 'self' data:; connect-src 'self'; object-src 'none'; base-uri 'none'; frame-ancestors 'none'; form-action 'self'; upgrade-insecure-requests
Content-Security-Policy: default-src 'self'; script-src 'self' 'unsafe-inline' https://static.cloudflareinsights.com; style-src 'self' https://fonts.googleapis.com 'unsafe-inline'; font-src 'self' https://fonts.gstatic.com; img-src 'self' https://ki5bhv.com data:; connect-src 'self' https://cloudflareinsights.com; object-src 'none'; base-uri 'none'; frame-ancestors 'none'; form-action 'self'; upgrade-insecure-requests
X-Content-Type-Options: nosniff
X-Frame-Options: DENY
Referrer-Policy: strict-origin-when-cross-origin