From d7576cb92510cf4ec083782b71cbc6e540dc6f4a Mon Sep 17 00:00:00 2001 From: maro Date: Fri, 18 Sep 2026 01:27:07 +0200 Subject: [PATCH] Allow Turnstile in frontend CSP --- next.config.ts | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/next.config.ts b/next.config.ts index 512f668..0d6d35a 100644 --- a/next.config.ts +++ b/next.config.ts @@ -22,9 +22,8 @@ const baseSecurityHeaders = [ // Deliberately NOT applied to /admin or /api: Payload's admin bundle isn't // audited here for CSP compatibility, and API routes serve data, not HTML, -// so a content policy doesn't apply to them anyway. connect-src stays broad -// because the WebRTC call pages connect to the separately hosted LiveKit SFU -// at runtime. style-src needs +// so a content policy doesn't apply to them anyway. connect-src permits the +// separately hosted LiveKit SFU and Cloudflare Turnstile at runtime. style-src needs // 'unsafe-inline' because Next App Router emits inline RSC flight/bootstrap // scripts that are required for hydration. script-src allows 'unsafe-eval' // only in dev, matching Next's own documented CSP guidance - React uses eval @@ -33,12 +32,13 @@ const baseSecurityHeaders = [ const isDev = process.env.NODE_ENV === "development"; const frontendCSP = [ "default-src 'self'", - `script-src 'self' 'unsafe-inline'${isDev ? " 'unsafe-eval'" : ""}`, + `script-src 'self' 'unsafe-inline' https://challenges.cloudflare.com${isDev ? " 'unsafe-eval'" : ""}`, "style-src 'self' 'unsafe-inline'", "img-src 'self' data: blob:", "font-src 'self' data:", - "connect-src 'self' https: wss: stun: turn: turns:", + "connect-src 'self' https://challenges.cloudflare.com wss: stun: turn: turns:", "media-src 'self' blob:", + "frame-src 'self' https://challenges.cloudflare.com", "frame-ancestors 'self'", "base-uri 'self'", "form-action 'self'",