openvibers/openvibe.reviews Commits

Reviews: the CSP allows Cloudflare Web Analytics (the injected beacon was blocked on every page) (#59)

OP OpenVibers committed 29 days ago · ea84412d4f · 2 files, +17 −2

Cloudflare's edge injects its Web Analytics beacon (`static.cloudflareinsights.com/beacon.min.js`) into every page of this site, but the page CSP did not allow it. Every visitor's console showed a CSP violation, and no analytics came from this site. A signed-in browser pass of every site found it on News, Reviews, Coupons, Deals, Trade and Host. Wiki and Live already allow it.

- `script-src` gains `https://static.cloudflareinsights.com`.
- `connect-src` gains `https://cloudflareinsights.com`, where the beacon reports.

`test/csp-analytics.test.js` checks both.

Changes

ddiff --git a/server/app.js b/server/app.js
iindex 9e1cf35..9c3c4be 100644
---- a/server/app.js
++++ b/server/app.js
@@@ -76,12 +76,13 @@ function createApp({ config, svc, viewers, platform, sources, sync, keys, db, lo
          res.set('Referrer-Policy', 'strict-origin-when-cross-origin');
          res.set('Content-Security-Policy', [
              "default-src 'self'",
--            "script-src 'self' 'unsafe-inline' https://openvibe.network",
++            // Cloudflare Web Analytics: the edge injects its beacon into every page (as on Wiki and Live).
++            "script-src 'self' 'unsafe-inline' https://openvibe.network https://static.cloudflareinsights.com",
              "style-src 'self' 'unsafe-inline' https://openvibe.network https://fonts.googleapis.com https://cdnjs.cloudflare.com",
              "font-src 'self' data: https://fonts.gstatic.com https://cdnjs.cloudflare.com",
              "img-src 'self' data: https:",
              // openvibe.events: release notifications (release-watch's EventSource, openvibe-shared 1.17).
--            "connect-src 'self' https://openvibe.network https://openvibe.events",
++            "connect-src 'self' https://openvibe.network https://openvibe.events https://cloudflareinsights.com",
              "frame-src 'self' https://openvibe.network",
              "frame-ancestors 'self'",
              "form-action 'self' https://openvibe.network",
ddiff --git a/test/csp-analytics.test.js b/test/csp-analytics.test.js
nnew file mode 100644
iindex 0000000..ff8ec3a
---- /dev/null
++++ b/test/csp-analytics.test.js
@@@ -0,0 +1,14 @@
++'use strict';
++// The page CSP lets Cloudflare Web Analytics run: the edge injects its beacon (static.cloudflareinsights.com) into every
++// page and it reports to cloudflareinsights.com. Without them every visitor's console showed a CSP violation and no
++// analytics came from this site (a signed-in browser pass of every site, 2026-10-15). Wiki and Live allow the same.
++const assert = require('assert');
++const fs = require('fs');
++const path = require('path');
++
++const app = fs.readFileSync(path.join(__dirname, '..', 'server', 'app.js'), 'utf8');
++const script = /(scriptSrc|'script-src'|"script-src)[^\n]*/.exec(app);
++const connect = /(connectSrc|'connect-src'|"connect-src)[^\n]*/.exec(app);
++assert.ok(script && script[0].includes('https://static.cloudflareinsights.com'), 'script-src allows the beacon');
++assert.ok(connect && connect[0].includes('https://cloudflareinsights.com'), 'connect-src allows its reports');
++console.log('csp: Cloudflare Web Analytics is allowed');