Allow AdSense through public CSP

b58941cf7cdc0dd584328acad2140a38f62fc99a · 2026-09-10 00:54:10 -0700 · Steve Abrams

Files touched

M server.js

Diff

commit b58941cf7cdc0dd584328acad2140a38f62fc99a
Author: Steve Abrams <steve@designerwallcoverings.com>
Date:   Thu Sep 10 00:54:10 2026 -0700

    Allow AdSense through public CSP
---
 server.js | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/server.js b/server.js
index 5930e94..97f82bf 100644
--- a/server.js
+++ b/server.js
@@ -32,12 +32,13 @@ app.use((req, res, next) => {
   const isAdmin = req.path === '/admin' || req.path.indexOf('/admin/') === 0;
   // static.cloudflareinsights.com: CF auto-injects its Web-Analytics beacon on the proxied
   // zone; without this origin it's blocked by script-src and errors in every console.
-  const scriptSrc = isAdmin ? "script-src 'self' 'unsafe-inline'" : "script-src 'self' https://www.googletagmanager.com https://static.cloudflareinsights.com";
+  const scriptSrc = isAdmin ? "script-src 'self' 'unsafe-inline'" : "script-src 'self' https://www.googletagmanager.com https://static.cloudflareinsights.com https://pagead2.googlesyndication.com https://*.googlesyndication.com";
+  const frameSrc = isAdmin ? '' : '; frame-src https://googleads.g.doubleclick.net https://tpc.googlesyndication.com https://www.google.com';
   // NOTE: connect-src is intentionally OMITTED (and there is no default-src), so cross-origin
   // fetch/beacon is unrestricted — this is what lets GA4 send measurement to www.google-analytics.com
   // and the region*.google-analytics.com endpoints. If a default-src is EVER added here, you MUST
   // also add an explicit connect-src for those GA hosts or analytics beacons die silently.
-  res.set('Content-Security-Policy', `${scriptSrc}; frame-ancestors 'self'; object-src 'none'; base-uri 'none'`);
+  res.set('Content-Security-Policy', `${scriptSrc}${frameSrc}; frame-ancestors 'self'; object-src 'none'; base-uri 'none'`);
   next();
 });

← 0358e6e TK-11341: add AdSense Auto-Ads loader + ads.txt (revert to r · back to Interiordesignershowroom · Disclose AdSense cookies in privacy page 6145bf4 →