Allow AdSense through public CSP

adc428e7f50cc10a9fa492ddbb2809a763733ec9 · 2026-09-10 00:54:21 -0700 · Steve Abrams

Files touched

M server.js

Diff

commit adc428e7f50cc10a9fa492ddbb2809a763733ec9
Author: Steve Abrams <steve@designerwallcoverings.com>
Date:   Thu Sep 10 00:54:21 2026 -0700

    Allow AdSense through public CSP
---
 server.js | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/server.js b/server.js
index b7acb44..9448b58 100644
--- a/server.js
+++ b/server.js
@@ -52,6 +52,8 @@ app.use(helmet({
       scriptSrc: [
         "'self'", "'unsafe-inline'",
         'https://www.googletagmanager.com',
+        'https://pagead2.googlesyndication.com',
+        'https://*.googlesyndication.com',
         // Stripe.js + Elements
         'https://js.stripe.com', 'https://q.stripe.com'
       ],
@@ -63,6 +65,8 @@ app.use(helmet({
         'https://www.google.com',
         'https://www.google-analytics.com',
         'https://*.analytics.google.com',
+        'https://pagead2.googlesyndication.com',
+        'https://*.googlesyndication.com',
         // Stripe API + Elements telemetry
         'https://api.stripe.com', 'https://m.stripe.network', 'https://m.stripe.com',
         // OpenStreetMap Nominatim — client-side reverse-geocode on /map
@@ -82,6 +86,7 @@ app.use(helmet({
         'https://player.vimeo.com',
         // LinkedIn embeds for /watch industry posts.
         'https://www.linkedin.com'
+        ,'https://googleads.g.doubleclick.net', 'https://tpc.googlesyndication.com', 'https://www.google.com'
       ],
       frameAncestors: ["'none'"],
       formAction: ["'self'"],

← 15f17c0 TK-11341: add AdSense Auto-Ads loader + ads.txt (revert to r · back to NationalPaperHangers · gitignore: cover .env* and .env.bak* to prevent secret-file 4145ccd →