fix(csp): allow static.cloudflareinsights.com in public script-src

23f8ed4dfc3a371ca9b26490698fa0a27a3328de · 2026-08-09 17:14:18 -0700 · Steve Abrams

CF auto-injects its Web-Analytics beacon on the proxied zone; the strict
public script-src ('self' + googletagmanager) was blocking it -> a CSP
console error on every page. Added the CF Insights origin (public only;
/admin unchanged). Verified: public CSP now lists the origin, /admin still
'unsafe-inline'-only, server boots clean.

Files touched

M server.js

Diff

commit 23f8ed4dfc3a371ca9b26490698fa0a27a3328de
Author: Steve Abrams <steve@designerwallcoverings.com>
Date:   Sun Aug 9 17:14:18 2026 -0700

    fix(csp): allow static.cloudflareinsights.com in public script-src
    
    CF auto-injects its Web-Analytics beacon on the proxied zone; the strict
    public script-src ('self' + googletagmanager) was blocking it -> a CSP
    console error on every page. Added the CF Insights origin (public only;
    /admin unchanged). Verified: public CSP now lists the origin, /admin still
    'unsafe-inline'-only, server boots clean.
---
 server.js | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/server.js b/server.js
index d30ed86..cc96924 100644
--- a/server.js
+++ b/server.js
@@ -29,7 +29,9 @@ app.use((req, res, next) => {
   // (behind auth, low XSS risk) so its one inline onsubmit confirm still works without
   // surgery on the concurrently-edited admin shell. ld+json is data, unaffected by script-src.
   const isAdmin = req.path === '/admin' || req.path.indexOf('/admin/') === 0;
-  const scriptSrc = isAdmin ? "script-src 'self' 'unsafe-inline'" : "script-src 'self' https://www.googletagmanager.com";
+  // static.cloudflareinsights.com: CF auto-injects its Web-Analytics beacon on the proxied
+  // zone; without this origin it's blocked by script-src and errors in every console.
+  const scriptSrc = isAdmin ? "script-src 'self' 'unsafe-inline'" : "script-src 'self' https://www.googletagmanager.com https://static.cloudflareinsights.com";
   // NOTE: connect-src is intentionally OMITTED (and there is no default-src), so cross-origin
   // fetch/beacon is unrestricted — this is what lets GA4 send measurement to www.google-analytics.com
   // and the region*.google-analytics.com endpoints. If a default-src is EVER added here, you MUST

← cb035b8 hardening: branded 404 page + remove orphan public/js/cart.j · back to Interiordesignershowroom · fix: graceful-degrade broken guide-hero + room-scene images 63069ec →