From a02fa3818b32da13955e9e2d694c158f206ab2ea Mon Sep 17 00:00:00 2001 From: Paijo <14921983+oyi77@users.noreply.github.com> Date: Sat, 18 Jul 2026 21:34:10 +0700 Subject: [PATCH] fix: add static.cloudflareinsights.com to CSP script-src (#7178) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit PR #7178 — The CSP was blocking the Cloudflare Web Analytics beacon (static.cloudflareinsights.com). Both dev and prod script-src directives need the domain for the analytics script to load. Co-authored-by: oyi77 --- next.config.mjs | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/next.config.mjs b/next.config.mjs index b3f7887bb5..fa46e3adbd 100644 --- a/next.config.mjs +++ b/next.config.mjs @@ -9,8 +9,8 @@ const distDir = process.env.NEXT_DIST_DIR || ".build/next"; const projectRoot = dirname(fileURLToPath(import.meta.url)); const scriptSrc = process.env.NODE_ENV === "development" - ? "script-src 'self' 'unsafe-inline' 'unsafe-eval' blob:" - : "script-src 'self' 'unsafe-inline' 'unsafe-eval' blob:"; + ? "script-src 'self' 'unsafe-inline' 'unsafe-eval' blob: https://static.cloudflareinsights.com" + : "script-src 'self' 'unsafe-inline' 'unsafe-eval' blob: https://static.cloudflareinsights.com"; const contentSecurityPolicy = [ "default-src 'self'", "base-uri 'self'",