JustinandClaude Sonnet 5
f45dfaa232
index.html carried two Content-Security-Policy meta tags that were never reconciled, so browsers enforced their intersection: the Cloudflare beacon script/connect endpoints, the profile photo from ki5bhv.com, and the page's own inline script/onerror handler all got silently blocked depending on which policy line was checked. Collapse index.html down to a single correct policy, and add the same static.cloudflareinsights.com / cloudflareinsights.com allowances to _headers (the actual Cloudflare Pages response header) and to k5bss.html's policy, since Cloudflare injects that beacon site-wide. Co-Authored-By: Claude Sonnet 5 <[email protected]>
10 lines
796 B
Plaintext
10 lines
796 B
Plaintext
/*
|
|
Content-Security-Policy: default-src 'self'; script-src 'self' 'unsafe-inline' https://static.cloudflareinsights.com; style-src 'self' https://fonts.googleapis.com 'unsafe-inline'; font-src 'self' https://fonts.gstatic.com; img-src 'self' https://ki5bhv.com data:; connect-src 'self' https://cloudflareinsights.com; object-src 'none'; base-uri 'none'; frame-ancestors 'none'; form-action 'self'; upgrade-insecure-requests
|
|
X-Content-Type-Options: nosniff
|
|
X-Frame-Options: DENY
|
|
Referrer-Policy: strict-origin-when-cross-origin
|
|
Permissions-Policy: accelerometer=(), camera=(), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), payment=(), usb=()
|
|
Cross-Origin-Opener-Policy: same-origin
|
|
Cross-Origin-Resource-Policy: same-origin
|
|
X-Permitted-Cross-Domain-Policies: none
|