JustinandClaude Sonnet 5
c7a10ae719
Two duplicate <meta> CSP tags in index.html conflicted with the _headers HTTP header, and browsers enforce the intersection of all active policies. That blocked the profile photo, the inline nav- highlight script, and the Cloudflare Insights beacon. Consolidate to a single CSP in _headers, allow the actual external resources the page needs (ki5bhv.com image, cloudflareinsights.com beacon), and move the inline script/onerror handler into js/main.js so script-src no longer needs 'unsafe-inline'. Co-Authored-By: Claude Sonnet 5 <[email protected]>
10 lines
780 B
Plaintext
10 lines
780 B
Plaintext
/*
|
|
Content-Security-Policy: default-src 'self'; script-src 'self' https://static.cloudflareinsights.com; style-src 'self' https://fonts.googleapis.com 'unsafe-inline'; font-src 'self' https://fonts.gstatic.com; img-src 'self' https://ki5bhv.com data:; connect-src 'self' https://cloudflareinsights.com; object-src 'none'; base-uri 'none'; frame-ancestors 'none'; form-action 'self'; upgrade-insecure-requests
|
|
X-Content-Type-Options: nosniff
|
|
X-Frame-Options: DENY
|
|
Referrer-Policy: strict-origin-when-cross-origin
|
|
Permissions-Policy: accelerometer=(), camera=(), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), payment=(), usb=()
|
|
Cross-Origin-Opener-Policy: same-origin
|
|
Cross-Origin-Resource-Policy: same-origin
|
|
X-Permitted-Cross-Domain-Policies: none
|