ankarhem.dev / site
This repository has no description
0
Fork 0

Configure Feed

Select the types of activity you want to include in your feed.

feat: disable <meta> CSP in favour of nginx response header (#2)

* feat: disable <meta> CSP in favour of nginx response header

The CSP is now served as an HTTP response header by nginx (nix-config
modules/blog.nix) so Cloudflare can parse a per-request nonce and stamp
it onto the scripts it injects at the edge. A <meta> CSP cannot carry a
nonce and would co-enforce alongside the header, re-blocking those
scripts.

* docs: explain why CSP <meta> is disabled

authored by

Jakob Ankarhem and committed by
GitHub (Jun 8, 2026, 6:15 PM +0200) add51eb5 d763bba4

+7 -7
+7 -7
zola.toml
··· 40 40 { name = "mastodon", url = "https://mastodon.social/@jakobankarhem" }, 41 41 ] 42 42 43 + # CSP is served as an HTTP response header by nginx (see nix-config 44 + # modules/blog.nix), not as a <meta> tag. This is required so Cloudflare's 45 + # JavaScript Detections can parse the per-request nonce from the header and 46 + # stamp it onto the inline scripts it injects at the edge (whose hashes change 47 + # every request and cannot be pinned). A <meta> CSP cannot carry a nonce and 48 + # would co-enforce alongside the header, re-blocking the injected scripts. 43 49 [extra.content_security_policy] 44 - enable = true 45 - allowed_domains = [ 46 - { directive = "base-uri", domains = ["'self'"] }, 47 - { directive = "connect-src", domains = ["'self'", "cloudflareinsights.com"] }, 48 - { directive = "form-action", domains = ["'self'"] }, 49 - { directive = "script-src", domains = ["'self'", "static.cloudflareinsights.com", "'sha512-8DS7rgIrAmghBFwoOTujcf6D9rXvH8xm8JQ1Ja01h9QX8EzXldiszufYa4IFfKdLUKTTrnSFXLDkUEOTrZQ8Qg=='"] }, 50 - ] 50 + enable = false