fix: allow data URLs in CSP for dynamic favicon

The dashboard status indicator favicon (colored circle) uses canvas
to generate a data URL that's set as the favicon. This was blocked
by CSP in staging/production because default-src didn't include data:.

Added data: to default-src directive to fix favicon not updating in
browser tabs when device status changes.

CHANGELOG.txt

@@ -25,6 +25,13 @@ fix: access interface stats through latest_stat association
   - Fixes production 500 error on device detail page
 Files: lib/towerops_web/live/device_live/show.html.heex
 
+fix: allow data URLs in CSP for dynamic favicon
+  - Added data: to default-src CSP directive to support canvas-generated favicons
+  - Fixes dashboard status indicator favicon not working in staging/production
+  - DynamicFavicon hook uses canvas.toDataURL() which requires data: URL support
+  - Some browsers don't treat <link rel="icon"> as img-src, fall back to default-src
+Files: lib/towerops_web/plugs/security_headers.ex
+
 2026-03-05
 feat: add rate limiting to admin endpoints (100 req/min)
   - Add :admin type to RateLimit plug with 100 requests per minute per IP

lib/towerops_web/plugs/security_headers.ex

@@ -26,7 +26,7 @@ defmodule ToweropsWeb.Plugs.SecurityHeaders do
   defp csp_header do
     Enum.join(
       [
-        "default-src 'self'",
+        "default-src 'self' data:",
         "script-src 'self' 'unsafe-inline'",
         "style-src 'self' 'unsafe-inline' 'unsafe-hashes'",
         "img-src 'self' data: https:",

priv/static/changelog.txt

@@ -2,6 +2,7 @@
 * Per-organization customization of free device limits and per-device pricing
 * Organization settings page now reflects custom billing terms when set
 * Fixed a crash on the device detail page when interface statistics were unavailable
+* Fixed dashboard status indicator favicon not updating in browser tab
 
 2026-03-05 — Security Enhancements
 * Enhanced security for API endpoints and file uploads