feat: Add Content Security Policy header and move Plausible script to HTML head with beforeInteractive strategy.

2025-11-25 22:19:34 +01:00
parent 1d62aca2fb
commit ffb7be602f
2 changed files with 13 additions and 2 deletions
--- a/app/layout.tsx
+++ b/app/layout.tsx
@@ -35,13 +35,15 @@ export default function RootLayout({
 }>) {
  return (
    <html lang="en">
-      <body className={`${geistSans.variable} ${geistMono.variable}`}>
+      <head>
        <Script
          defer
          data-domain="hoerdle.elpatron.me"
          src="https://plausible.elpatron.me/js/script.js"
-          strategy="afterInteractive"
+          strategy="beforeInteractive"
        />
+      </head>
+      <body className={`${geistSans.variable} ${geistMono.variable}`}>
        {children}
        <InstallPrompt />
        <AppFooter />
--- a/next.config.ts
+++ b/next.config.ts
@@ -15,6 +15,15 @@ const nextConfig: NextConfig = {
  },
  async headers() {
    return [
+      {
+        source: '/:path*',
+        headers: [
+          {
+            key: 'Content-Security-Policy',
+            value: "script-src 'self' 'unsafe-inline' 'unsafe-eval' https://plausible.elpatron.me; connect-src 'self' https://plausible.elpatron.me;",
+          },
+        ],
+      },
      {
        source: '/uploads/:path*.mp3',
        headers: [