hanzo/chat
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(csp): allow hanzo.app so the Contribute widget loads

Browse Source 
hanzo.chat embeds hanzo.app/edit.js on every page, but script-src listed
only analytics + cloudflareinsights, so the widget was CSP-blocked. Add
hanzo.app to script-src (load) and connect-src (its /v1 calls).
This commit is contained in:
zeekay
2026-07-25 10:53:05 -07:00
parent 8a604750b1
commit ecdc089858
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
api/server/index.js
+1 -1
View File
@@ -136,7 +136,7 @@ const startServer = async () => {
res.setHeader('Referrer-Policy', 'strict-origin-when-cross-origin');
res.setHeader(
'Content-Security-Policy',
"default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://hanzo.app https://analytics.hanzo.ai https://static.cloudflareinsights.com; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob: https:; font-src 'self' data:; media-src 'self' data: blob:; connect-src 'self' https://*.hanzo.ai https://*.hanzo.chat wss://*.hanzo.chat https://static.cloudflareinsights.com https://cloudflareinsights.com; frame-ancestors 'none';",
"default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://hanzo.app https://analytics.hanzo.ai https://static.cloudflareinsights.com; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob: https:; font-src 'self' data:; media-src 'self' data: blob:; connect-src 'self' https://hanzo.app https://*.hanzo.ai https://*.hanzo.chat wss://*.hanzo.chat https://static.cloudflareinsights.com https://cloudflareinsights.com; frame-ancestors 'none';",
);
res.setHeader('Permissions-Policy', 'camera=(), microphone=(), geolocation=()');
next();