From ba8c74b19c467ff0bc745eeacd7e8269dfe4e7e3 Mon Sep 17 00:00:00 2001 From: Ash Date: Sat, 11 Jul 2026 07:21:18 +0900 Subject: [PATCH] Allow Cloudflare Web Analytics through CSP --- scripts/security-headers.mjs | 2 +- test/security-headers.test.mjs | 1 + 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/scripts/security-headers.mjs b/scripts/security-headers.mjs index fd10495..e77e00f 100644 --- a/scripts/security-headers.mjs +++ b/scripts/security-headers.mjs @@ -26,7 +26,7 @@ export function buildContentSecurityPolicy(scriptHashes) { "object-src 'none'", "frame-ancestors 'none'", "form-action 'self'", - `script-src 'self' ${scriptHashes.join(" ")} https://www.googletagmanager.com`, + `script-src 'self' ${scriptHashes.join(" ")} https://www.googletagmanager.com https://static.cloudflareinsights.com`, "script-src-attr 'none'", "style-src 'self'", "style-src-attr 'none'", diff --git a/test/security-headers.test.mjs b/test/security-headers.test.mjs index be4fb76..e554361 100644 --- a/test/security-headers.test.mjs +++ b/test/security-headers.test.mjs @@ -20,6 +20,7 @@ describe("Cloudflare security headers", () => { expect(hashes).toEqual([`'sha256-${expected}'`]); expect(policy).toContain("script-src 'self'"); + expect(policy).toContain("https://static.cloudflareinsights.com"); expect(policy).toContain("script-src-attr 'none'"); expect(policy).not.toContain("'unsafe-inline'"); expect(policy).not.toContain("'unsafe-eval'");