OXYGENHUB

Move inline scripts and handlers into hub.js so the CSP can be enforced issue #227 closed: completed andymccall opened this · 3 comments

andymccall

The Content Security Policy from issue #222 is report-only because the pages still carry inline code: five inline

andymccall set labels security ·

andymccall referenced by change a7aa76ac52d7 on main ·

andymccall

Inline code is gone (hub 038edb8a):

  • the look/theme script moved to early.js (still blocking in );
  • the pulse chart to pulse.js, the backdrop start to backdrop-boot.js (a module), the mail panel toggle to hub.js;
  • 25 confirm/autosubmit/select handlers became data-confirm / data-autosubmit / data-select, handled in hub.js;
  • a test (tests/csp.rs) fails if a template gains inline code again.

Live on oxygenhub.io since 03:13. Left, as the issue says: watch the log for csp would block for a few days, then flip ENFORCE in crates/hub/src/headers.rs.

andymccall

Correction to the comment above: live since about 02:10 BST on 2026-10-18, not 03:13.

andymccall

Board tidy (2026-10-19): in the two days since report-only went live, the hub logged only 5 csp would block reports, all the same: script-src-elem https://static.cloudflareinsights.com/beacon.min.js, Cloudflare's Web Analytics beacon, which Cloudflare injects at the edge (not ours). Left: flip ENFORCE in crates/hub/src/headers.rs, after one decision for Andy: allow the beacon (script-src https://static.cloudflareinsights.com, connect-src https://cloudflareinsights.com) or let enforcement block it (turn Web Analytics off in Cloudflare, or lose those numbers).

closed by change 0468394734e9 ·