Make staging runtime configuration compatible with strict CSP #58

New Issue

timmy · 2026-08-21T14:56:09Z

timmy commented

2026-08-21 14:56:09 +00:00

Parent: #57

Provisioning preflight found that the reviewed Caddy CSP script-src 'self' blocks the inline window.__TIMMY_CONFIG__ inserted by server.mjs. Fix before live reload without adding unsafe-inline.

Serve bounded runtime configuration as a same-origin external JavaScript resource under the configured base path.
Load it before app.js; remove inline executable config.
Preserve safe release/base-path/staging-label encoding and root compatibility.
Add browser acceptance with the exact staging CSP and verify no CSP console violations.
Keep Caddy script-src 'self' and do not deploy in this issue.

Parent: #57 Provisioning preflight found that the reviewed Caddy CSP `script-src 'self'` blocks the inline `window.__TIMMY_CONFIG__` inserted by `server.mjs`. Fix before live reload without adding `unsafe-inline`. - Serve bounded runtime configuration as a same-origin external JavaScript resource under the configured base path. - Load it before `app.js`; remove inline executable config. - Preserve safe release/base-path/staging-label encoding and root compatibility. - Add browser acceptance with the exact staging CSP and verify no CSP console violations. - Keep Caddy `script-src 'self'` and do not deploy in this issue.

timmy added this to the M3 — Private Beta & Longitudinal Value milestone 2026-08-21 14:56:09 +00:00

timmy added the

labels 2026-08-21 14:56:09 +00:00

timmy referenced a pull request that will close this issue

2026-08-21 14:59:46 +00:00

Make staging runtime configuration compatible with strict CSP #59