From 0d961e887f556f625f45aa11edecbb2a3e96f7a0 Mon Sep 17 00:00:00 2001 From: Graham McIntire Date: Wed, 29 Apr 2026 14:24:04 -0500 Subject: [PATCH] fix: allow Plausible analytics domain in CSP Add https://a.w5isp.com to script-src and connect-src so the analytics script loads and event POSTs are not blocked. --- lib/towerops_web/plugs/security_headers.ex | 4 ++-- test/towerops_web/plugs/security_headers_test.exs | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/lib/towerops_web/plugs/security_headers.ex b/lib/towerops_web/plugs/security_headers.ex index 5deb72d1..ff01c0da 100644 --- a/lib/towerops_web/plugs/security_headers.ex +++ b/lib/towerops_web/plugs/security_headers.ex @@ -27,11 +27,11 @@ defmodule ToweropsWeb.Plugs.SecurityHeaders do Enum.join( [ "default-src 'self' data:", - "script-src 'self' 'unsafe-inline'", + "script-src 'self' 'unsafe-inline' https://a.w5isp.com", "style-src 'self' 'unsafe-inline' 'unsafe-hashes'", "img-src 'self' data: https:", "font-src 'self' data:", - "connect-src 'self' ws: wss:", + "connect-src 'self' ws: wss: https://a.w5isp.com", "frame-ancestors 'none'" ], "; " diff --git a/test/towerops_web/plugs/security_headers_test.exs b/test/towerops_web/plugs/security_headers_test.exs index 27843a74..43a86717 100644 --- a/test/towerops_web/plugs/security_headers_test.exs +++ b/test/towerops_web/plugs/security_headers_test.exs @@ -15,12 +15,12 @@ defmodule ToweropsWeb.Plugs.SecurityHeadersTest do [csp] = get_resp_header(conn, "content-security-policy") assert csp =~ "default-src 'self'" - assert csp =~ "script-src 'self' 'unsafe-inline'" + assert csp =~ "script-src 'self' 'unsafe-inline' https://a.w5isp.com" refute csp =~ "unsafe-eval" assert csp =~ "style-src 'self' 'unsafe-inline' 'unsafe-hashes'" assert csp =~ "img-src 'self' data: https:" assert csp =~ "font-src 'self' data:" - assert csp =~ "connect-src 'self' ws: wss:" + assert csp =~ "connect-src 'self' ws: wss: https://a.w5isp.com" assert csp =~ "frame-ancestors 'none'" end end