[object Object]

← back to Dear Bubbe Nextjs

fix(csp): allow Cloudflare Insights beacon (+ GA4 regional) — clears console CSP refusal

84b91bc13ce678d8f035e9069af418f404f5c7f1 · 2026-07-16 17:37:50 -0700 · Steve Abrams

- script-src: + https://static.cloudflareinsights.com
- connect-src: + https://cloudflareinsights.com https://*.google-analytics.com https://www.google.com
- verified on WebKit: console now 0 errors, chat unaffected; /api/auth/providers stays 200 (that '404' was a false reading, no fix needed)

Files touched

Diff

commit 84b91bc13ce678d8f035e9069af418f404f5c7f1
Author: Steve Abrams <steve@designerwallcoverings.com>
Date:   Thu Jul 16 17:37:50 2026 -0700

    fix(csp): allow Cloudflare Insights beacon (+ GA4 regional) — clears console CSP refusal
    
    - script-src: + https://static.cloudflareinsights.com
    - connect-src: + https://cloudflareinsights.com https://*.google-analytics.com https://www.google.com
    - verified on WebKit: console now 0 errors, chat unaffected; /api/auth/providers stays 200 (that '404' was a false reading, no fix needed)
---
 next.config.ts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/next.config.ts b/next.config.ts
index 6587434..935cb31 100644
--- a/next.config.ts
+++ b/next.config.ts
@@ -41,7 +41,7 @@ const nextConfig: NextConfig = {
           },
           {
             key: 'Content-Security-Policy',
-            value: "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://www.googletagmanager.com https://www.google-analytics.com; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.com; img-src 'self' data: blob: https:; media-src 'self' data: blob:; connect-src 'self' https://api.anthropic.com https://api.elevenlabs.io https://www.google-analytics.com; frame-ancestors 'none';",
+            value: "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://www.googletagmanager.com https://www.google-analytics.com https://static.cloudflareinsights.com; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.com; img-src 'self' data: blob: https:; media-src 'self' data: blob:; connect-src 'self' https://api.anthropic.com https://api.elevenlabs.io https://www.google-analytics.com https://*.google-analytics.com https://www.google.com https://cloudflareinsights.com; frame-ancestors 'none';",
           },
         ],
       },

← f7be260 fix(voice): Bubbe never speaks over herself + slightly faste  ·  back to Dear Bubbe Nextjs  ·  auto-save: 2026-07-16T17:43:55 (3 files) — app/api/social-po 0dbdfa0 →