From 922c2c1aec02885235ebcb35c462d572b75c6df5 Mon Sep 17 00:00:00 2001 From: neodk2004 Date: Tue, 1 Sep 2026 20:58:07 +0200 Subject: [PATCH] =?UTF-8?q?docs:=20correct=20script-src=20comment=20?= =?UTF-8?q?=E2=80=94=20strict-dynamic=20ignores=20the=20added=20host?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Verified live that adding Clerk's frontend API host to script-src does NOT resolve the CSP violation in modern browsers: with 'strict-dynamic' present, CSP3 ignores host-based entries in that directive entirely (Chrome's own violation message confirms this). The console noise is a Clerk SDK-side loading quirk, not something fixable here without dropping 'strict-dynamic'. Keeping the host entry only as the same spec-mandated pre-CSP3 fallback the existing 'unsafe-inline' entry already relies on, with the comment corrected to say so. --- src/proxy.ts | 21 ++++++++++++++++----- 1 file changed, 16 insertions(+), 5 deletions(-) diff --git a/src/proxy.ts b/src/proxy.ts index a2811a0..48feed7 100644 --- a/src/proxy.ts +++ b/src/proxy.ts @@ -171,11 +171,22 @@ export default clerkMiddleware( reportTo: "/api/csp-report", directives: { // Clerk's own middleware adds its frontend API host to connect-src - // automatically, but NOT to script-src — without this, the initial - // (unversioned) clerk.browser.js/ui.browser.js load is blocked by - // 'strict-dynamic' before the 307 redirect to the versioned URL, - // producing two CSP violations (reported to /api/csp-report) on - // every page load that renders Clerk UI. + // automatically, but NOT to script-src. Added it here too, but + // verified (2026-09-01) this does NOT fix it: with 'strict-dynamic' + // present, CSP3 browsers ignore host-based entries in script-src + // entirely (same reasoning as the 'unsafe-inline' fallback comment + // above) — Chrome's own violation message confirms this ("Note that + // 'strict-dynamic' is present, so host-based allowlisting is + // disabled"). The initial (unversioned) clerk.browser.js/ui.browser.js + // load still gets blocked before its 307 redirect to the versioned + // URL, producing two harmless-but-noisy CSP violations (reported to + // /api/csp-report) on every page that renders Clerk UI — Clerk loads + // fine via the redirect regardless. Root cause is on Clerk's side + // (that script tag isn't part of a nonce-trusted load chain); fixing + // it here would mean dropping 'strict-dynamic', a real regression + // from the CSP Enforcement hardening. Kept only as the same + // spec-mandated pre-CSP3 fallback the 'unsafe-inline' entry already + // relies on. "script-src": [`https://${getClerkFrontendApiHostname()}`, "unsafe-eval", "'report-sample'"], "img-src": [`https://${getSupabaseHostname()}`, "https://image.mux.com", "blob:"], "connect-src": [