From 7b67897612d3cf0490334198c910a7f8f6e5a3dc Mon Sep 17 00:00:00 2001 From: platform-mcp Date: Wed, 24 Jun 2026 01:38:51 +0530 Subject: [PATCH] fix(csp): allow WRNexus push SDK origin in script-src and connect-src The web-push SDK (https://api.wrnexus.com/push/sdk.js) and its runtime config fetch were blocked by the Content-Security-Policy set in src/middleware.ts. Added https://api.wrnexus.com to script-src (prod and dev) and connect-src. No wildcards introduced; existing analytics origins (GTM, GA, Plausible) unchanged. Co-Authored-By: Claude Opus 4.8 --- src/middleware.ts | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/src/middleware.ts b/src/middleware.ts index 4a51854..3e8649e 100644 --- a/src/middleware.ts +++ b/src/middleware.ts @@ -155,11 +155,12 @@ export const onRequest = defineMiddleware(async (context, next) => { // - inline scripts/styles: Required for Astro framework // - https://www.googletagmanager.com & https://www.google-analytics.com: GA4 // - https://plausible.io: Plausible Analytics + // - https://api.wrnexus.com: WRNexus web-push SDK (sdk.js) + runtime config // Note: unsafe-eval is removed in production (only needed during Astro HMR dev mode) const isProduction = import.meta.env.PROD; const scriptSrc = isProduction - ? "script-src 'self' 'unsafe-inline' https://www.googletagmanager.com https://www.google-analytics.com https://plausible.io" - : "script-src 'self' 'unsafe-inline' 'unsafe-eval' https://www.googletagmanager.com https://www.google-analytics.com https://plausible.io"; + ? "script-src 'self' 'unsafe-inline' https://www.googletagmanager.com https://www.google-analytics.com https://plausible.io https://api.wrnexus.com" + : "script-src 'self' 'unsafe-inline' 'unsafe-eval' https://www.googletagmanager.com https://www.google-analytics.com https://plausible.io https://api.wrnexus.com"; const csp = [ "default-src 'self'", @@ -167,7 +168,7 @@ export const onRequest = defineMiddleware(async (context, next) => { "style-src 'self' 'unsafe-inline' https://fonts.googleapis.com", "img-src 'self' data: https://images.unsplash.com https://www.google-analytics.com https://www.googletagmanager.com https://maps.googleapis.com https://maps.gstatic.com", "font-src 'self' data: https://fonts.gstatic.com", - "connect-src 'self' https://www.google-analytics.com https://analytics.google.com https://stats.g.doubleclick.net https://plausible.io", + "connect-src 'self' https://www.google-analytics.com https://analytics.google.com https://stats.g.doubleclick.net https://plausible.io https://api.wrnexus.com", "worker-src 'self'", "manifest-src 'self'", "object-src 'none'", // Block Flash/plugins (defense-in-depth)