openvibers/openvibe.host Commits

Host: the CSP allows Cloudflare Web Analytics (the injected beacon was blocked on every page) (#107)

OP OpenVibers committed 29 days ago · f24059480c · 2 files, +17 −2

Cloudflare's edge injects its Web Analytics beacon (`static.cloudflareinsights.com/beacon.min.js`) into every page of this site, but the page CSP did not allow it. Every visitor's console showed a CSP violation, and no analytics came from this site. A signed-in browser pass of every site found it on News, Reviews, Coupons, Deals, Trade and Host. Wiki and Live already allow it.

- `script-src` gains `https://static.cloudflareinsights.com`.
- `connect-src` gains `https://cloudflareinsights.com`, where the beacon reports.

`test/csp-analytics.test.js` checks both.

Changes

ddiff --git a/server/app.js b/server/app.js
iindex 8db5084..91f3a3b 100644
---- a/server/app.js
++++ b/server/app.js
@@@ -34,11 +34,12 @@ const SPACE_URL = 'https://openvibe.space';
  const MOVED = 'Static hosting moved to OpenVibe.Space.';
  const DASHBOARD_CSP_HEADER = Object.entries({
      'default-src': ["'self'"],
--    'script-src': ["'self'", "'unsafe-inline'", 'https://openvibe.network'],
++    // Cloudflare Web Analytics: the edge injects its beacon into every page (as on Wiki and Live).
++    'script-src': ["'self'", "'unsafe-inline'", 'https://openvibe.network', 'https://static.cloudflareinsights.com'],
      'style-src': ["'self'", "'unsafe-inline'", 'https://openvibe.network', 'https://fonts.googleapis.com', 'https://cdnjs.cloudflare.com'],
      'font-src': ["'self'", 'data:', 'https://fonts.gstatic.com', 'https://cdnjs.cloudflare.com'],
      'img-src': ["'self'", 'data:', 'https:'],
--    'connect-src': ["'self'", 'https://openvibe.network', 'https://openvibe.events'],
++    'connect-src': ["'self'", 'https://openvibe.network', 'https://openvibe.events', 'https://cloudflareinsights.com'],
      'frame-src': ["'self'", 'https://openvibe.network'],
      'frame-ancestors': ["'none'"], 'object-src': ["'none'"], 'base-uri': ["'self'"],
      'form-action': ["'self'", 'https://openvibe.network'],
ddiff --git a/test/csp-analytics.test.js b/test/csp-analytics.test.js
nnew file mode 100644
iindex 0000000..ff8ec3a
---- /dev/null
++++ b/test/csp-analytics.test.js
@@@ -0,0 +1,14 @@
++'use strict';
++// The page CSP lets Cloudflare Web Analytics run: the edge injects its beacon (static.cloudflareinsights.com) into every
++// page and it reports to cloudflareinsights.com. Without them every visitor's console showed a CSP violation and no
++// analytics came from this site (a signed-in browser pass of every site, 2026-10-15). Wiki and Live allow the same.
++const assert = require('assert');
++const fs = require('fs');
++const path = require('path');
++
++const app = fs.readFileSync(path.join(__dirname, '..', 'server', 'app.js'), 'utf8');
++const script = /(scriptSrc|'script-src'|"script-src)[^\n]*/.exec(app);
++const connect = /(connectSrc|'connect-src'|"connect-src)[^\n]*/.exec(app);
++assert.ok(script && script[0].includes('https://static.cloudflareinsights.com'), 'script-src allows the beacon');
++assert.ok(connect && connect[0].includes('https://cloudflareinsights.com'), 'connect-src allows its reports');
++console.log('csp: Cloudflare Web Analytics is allowed');