From d02e4f026106367f623c07f8b3565632fe45d31f Mon Sep 17 00:00:00 2001 From: Bissbert <43237892+Bissbert@users.noreply.github.com> Date: Wed, 15 Jul 2026 21:43:02 +0200 Subject: [PATCH] fix(csp): allow data: in connect-src for embedded glTF buffer fetches The hero crystal 3D model loads a glTF whose buffers are embedded as data: URIs; three.js fetches them, which the connect-src directive blocked, producing console errors on every homepage load. data: in connect-src is low-risk (no exfiltration channel). --- public/_headers | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/public/_headers b/public/_headers index 297a376..0e8795c 100644 --- a/public/_headers +++ b/public/_headers @@ -3,7 +3,7 @@ X-Frame-Options: DENY Referrer-Policy: strict-origin-when-cross-origin Permissions-Policy: camera=(), microphone=(), geolocation=(), interest-cohort=() - Content-Security-Policy: default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://cdn.jsdelivr.net https://static.cloudflareinsights.com; script-src-elem 'self' 'unsafe-inline' https://cdn.jsdelivr.net https://static.cloudflareinsights.com; style-src 'self' 'unsafe-inline' https://cdn.jsdelivr.net; img-src 'self' data: blob:; font-src 'self' data: https://cdn.jsdelivr.net; connect-src 'self' https://api.gemmology.dev https://cloudflareinsights.com https://cdn.jsdelivr.net; worker-src 'self' blob:; frame-ancestors 'none'; base-uri 'self'; form-action 'self' + Content-Security-Policy: default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://cdn.jsdelivr.net https://static.cloudflareinsights.com; script-src-elem 'self' 'unsafe-inline' https://cdn.jsdelivr.net https://static.cloudflareinsights.com; style-src 'self' 'unsafe-inline' https://cdn.jsdelivr.net; img-src 'self' data: blob:; font-src 'self' data: https://cdn.jsdelivr.net; connect-src 'self' data: https://api.gemmology.dev https://cloudflareinsights.com https://cdn.jsdelivr.net; worker-src 'self' blob:; frame-ancestors 'none'; base-uri 'self'; form-action 'self' Strict-Transport-Security: max-age=31536000; includeSubDomains; preload # Long-cache versioned static assets (Astro hashed bundle)