openvibers/openvibe.news Commits

News: the CSP allows Cloudflare Web Analytics (the injected beacon was blocked on every page) (#62)

OP OpenVibers committed 29 days ago · 7d8c083d90 · 2 files, +17 −2

Cloudflare's edge injects its Web Analytics beacon (`static.cloudflareinsights.com/beacon.min.js`) into every page of this site, but the page CSP did not allow it. Every visitor's console showed a CSP violation, and no analytics came from this site. A signed-in browser pass of every site found it on News, Reviews, Coupons, Deals, Trade and Host. Wiki and Live already allow it.

- `script-src` gains `https://static.cloudflareinsights.com`.
- `connect-src` gains `https://cloudflareinsights.com`, where the beacon reports.

`test/csp-analytics.test.js` checks both.

Changes

ddiff --git a/server/app.js b/server/app.js
iindex 8811324..d247019 100644
---- a/server/app.js
++++ b/server/app.js
@@@ -120,12 +120,13 @@ async function createApp(opts = {}) {
              directives: {
                  defaultSrc: ["'self'"],
                  // The OpenVibe Frame (theme-loader, navbar, footer) comes from the Network; the inline init is ours.
--                scriptSrc: ["'self'", "'unsafe-inline'", 'https://openvibe.network'],
++                // Cloudflare Web Analytics: the edge injects its beacon into every page (as on Wiki and Live).
++                scriptSrc: ["'self'", "'unsafe-inline'", 'https://openvibe.network', 'https://static.cloudflareinsights.com'],
                  styleSrc: ["'self'", "'unsafe-inline'", 'https://openvibe.network', 'https://fonts.googleapis.com', 'https://cdnjs.cloudflare.com'],
                  fontSrc: ["'self'", 'data:', 'https://fonts.gstatic.com', 'https://cdnjs.cloudflare.com'],
                  imgSrc: ["'self'", 'data:', 'https:'],
                  // openvibe.events: release notifications (release-watch's EventSource, openvibe-shared 1.17).
--                connectSrc: ["'self'", 'https://openvibe.network', 'https://openvibe.events'],
++                connectSrc: ["'self'", 'https://openvibe.network', 'https://openvibe.events', 'https://cloudflareinsights.com'],
                  frameSrc: ["'self'", 'https://openvibe.network'],
                  frameAncestors: ["'self'"],
                  objectSrc: ["'none'"],
ddiff --git a/test/csp-analytics.test.js b/test/csp-analytics.test.js
nnew file mode 100644
iindex 0000000..ff8ec3a
---- /dev/null
++++ b/test/csp-analytics.test.js
@@@ -0,0 +1,14 @@
++'use strict';
++// The page CSP lets Cloudflare Web Analytics run: the edge injects its beacon (static.cloudflareinsights.com) into every
++// page and it reports to cloudflareinsights.com. Without them every visitor's console showed a CSP violation and no
++// analytics came from this site (a signed-in browser pass of every site, 2026-10-15). Wiki and Live allow the same.
++const assert = require('assert');
++const fs = require('fs');
++const path = require('path');
++
++const app = fs.readFileSync(path.join(__dirname, '..', 'server', 'app.js'), 'utf8');
++const script = /(scriptSrc|'script-src'|"script-src)[^\n]*/.exec(app);
++const connect = /(connectSrc|'connect-src'|"connect-src)[^\n]*/.exec(app);
++assert.ok(script && script[0].includes('https://static.cloudflareinsights.com'), 'script-src allows the beacon');
++assert.ok(connect && connect[0].includes('https://cloudflareinsights.com'), 'connect-src allows its reports');
++console.log('csp: Cloudflare Web Analytics is allowed');