From e6c1bfd28e86081611735f3e29de32912aa8aa16 Mon Sep 17 00:00:00 2001 From: neodk2004 Date: Mon, 10 Aug 2026 08:08:19 +0200 Subject: [PATCH] docs(security): document why CSP is drafted but not yet enforced Enforcing it blanked the whole app in production (ClerkProvider wraps the tree in layout.tsx; a blocked resource during Clerk's client init throws uncaught). Adding wss://clerk.pawfeed.org to connect-src did not fix it. Next attempt: ship as Content-Security-Policy-Report-Only first to see real violation reports before enforcing again. All other security headers (HSTS, X-Frame-Options, etc.) and rate limiting stay active and are unaffected. --- next.config.ts | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/next.config.ts b/next.config.ts index 650e217..9d11568 100644 --- a/next.config.ts +++ b/next.config.ts @@ -11,6 +11,15 @@ function getSupabaseHostname(): string { return "*.supabase.co"; } +// Drafted but NOT wired into headers() yet — enabling it blanked the entire +// app (ClerkProvider wraps the whole tree in layout.tsx; a blocked resource +// during its client-side init throws, and nothing catches it, so the app +// crashes to a blank page instead of just breaking the login widget). +// Confirmed live on 2026-08-10 that disabling this CSP fixes it; adding +// wss://clerk.pawfeed.org to connect-src did NOT fix it, so the real blocked +// directive is still unidentified. Next attempt should ship as +// Content-Security-Policy-Report-Only first (with a /api/csp-report endpoint) +// to see actual violation reports before enforcing on production again. function buildCsp(): string { const supabase = `https://${getSupabaseHostname()}`; const directives: Record = {