From e678e21ee8d8f53fb9c9b5a9dbf7fd7be48417ec Mon Sep 17 00:00:00 2001 From: Arnaud Date: Sun, 12 Jul 2026 19:07:43 +0200 Subject: [PATCH] =?UTF-8?q?fix:=20API=20Reference=20page=20(/docs)=20blank?= =?UTF-8?q?=20=E2=80=94=20CSP=20blocked=20the=20Scalar=20bundle?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit script-src had no allowance for cdn.jsdelivr.net, which is where the Scalar API-reference viewer's JS is loaded from — the script itself never ran. Added it to script-src/style-src/font-src/connect-src. (User-confirmed before applying — widens what's allowed to load, so wanted explicit sign-off rather than just doing it in response to a console error.) --- apps/web/next.config.ts | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/apps/web/next.config.ts b/apps/web/next.config.ts index 548b15b..c484440 100644 --- a/apps/web/next.config.ts +++ b/apps/web/next.config.ts @@ -33,11 +33,11 @@ const securityHeaders = [ key: "Content-Security-Policy", value: [ "default-src 'self'", - "script-src 'self' 'unsafe-inline' 'unsafe-eval'", // unsafe-eval needed by Next.js dev; tighten in prod - "style-src 'self' 'unsafe-inline'", + "script-src 'self' 'unsafe-inline' 'unsafe-eval' https://cdn.jsdelivr.net", // unsafe-eval needed by Next.js dev; tighten in prod. jsdelivr serves the Scalar API-reference bundle on /docs. + "style-src 'self' 'unsafe-inline' https://cdn.jsdelivr.net", `img-src 'self' data: blob: ${storageOrigin} https://www.gravatar.com`, - "font-src 'self'", - `connect-src 'self' ${storageOrigin}`, + "font-src 'self' https://cdn.jsdelivr.net data:", + `connect-src 'self' ${storageOrigin} https://cdn.jsdelivr.net`, "frame-ancestors 'none'", "base-uri 'self'", "form-action 'self'",