feat: add plausible.elpatron.me to CSP script-src and connect-src directives.

chore: remove Content-Security-Policy header configuration
feat: Add Content Security Policy header and move Plausible script to HTML head with beforeInteractive strategy.
2025-11-25 22:34:32 +01:00 · 2025-11-25 22:31:13 +01:00 · 2025-11-25 22:19:34 +01:00 · 2025-11-25 22:13:46 +01:00
2 changed files with 11 additions and 2 deletions
--- a/app/layout.tsx
+++ b/app/layout.tsx
@@ -1,5 +1,6 @@
 import type { Metadata, Viewport } from "next";
 import { Geist, Geist_Mono } from "next/font/google";
 import Script from "next/script";
 import "./globals.css";
 const geistSans = Geist({
@@ -34,6 +35,14 @@ export default function RootLayout({
 }>) {
  return (
    <html lang="en">
      <head>
        <Script
          defer
          data-domain="hoerdle.elpatron.me"
          src="https://plausible.elpatron.me/js/script.js"
          strategy="beforeInteractive"
        />
      </head>
      <body className={`${geistSans.variable} ${geistMono.variable}`}>
        {children}
        <InstallPrompt />
--- a/middleware.ts
+++ b/middleware.ts
@@ -25,11 +25,11 @@ export function middleware(request: NextRequest) {
    // Content Security Policy
    const csp = [
        "default-src 'self'",
-        "script-src 'self' 'unsafe-inline' 'unsafe-eval'", // Next.js requires unsafe-inline/eval
+        "script-src 'self' 'unsafe-inline' 'unsafe-eval' https://plausible.elpatron.me", // Next.js requires unsafe-inline/eval
        "style-src 'self' 'unsafe-inline'", // Allow inline styles
        "img-src 'self' data: blob:",
        "font-src 'self' data:",
-        "connect-src 'self' https://openrouter.ai https://gotify.example.com",
+        "connect-src 'self' https://openrouter.ai https://gotify.example.com https://plausible.elpatron.me",
        "media-src 'self' blob:",
        "frame-ancestors 'self'",
    ].join('; ');
Author	SHA1	Message	Date
Hördle Bot	0877842107	feat: add plausible.elpatron.me to CSP script-src and connect-src directives.	2025-11-25 22:34:32 +01:00
Hördle Bot	a5cbbffc20	chore: remove Content-Security-Policy header configuration	2025-11-25 22:31:13 +01:00
Hördle Bot	ffb7be602f	feat: Add Content Security Policy header and move Plausible script to HTML head with `beforeInteractive` strategy.	2025-11-25 22:19:34 +01:00
Hördle Bot	1d62aca2fb	feat: add Plausible Analytics script to layout for tracking.	2025-11-25 22:13:46 +01:00