mirror of
https://github.com/screentinker/screentinker.git
synced 2026-08-13 22:03:13 -06:00
a0b47000f3
The dashboard CSP (script-src 'self') blocked Cloudflare's Web Analytics beacon. Add the two exact entries the beacon needs (both required — script-only loads but silently can't report): - script-src: https://static.cloudflareinsights.com (beacon script loads) - connect-src: https://cloudflareinsights.com (beacon POSTs analytics back) Exact domains, no wildcards. connect-src already had 'wss:'/'ws:' (socket.io) + 'https:' — those stay, so the dashboard socket is unaffected; the explicit CF domain documents intent and survives any future tightening of the broad 'https:'. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> |
||
|---|---|---|
| .. | ||
| config | ||
| db | ||
| lib | ||
| middleware | ||
| player | ||
| routes | ||
| scripts | ||
| services | ||
| test | ||
| ws | ||
| .gitignore | ||
| config.js | ||
| package-lock.json | ||
| package.json | ||
| server.js | ||
| version.js | ||