From 6d3fc15f4ac06af995ca8c912bbd04187557e2e6 Mon Sep 17 00:00:00 2001 From: Graham McIntire Date: Fri, 6 Mar 2026 13:51:31 -0600 Subject: [PATCH] fix: allow data URLs in CSP for dynamic favicon The dashboard status indicator favicon (colored circle) uses canvas to generate a data URL that's set as the favicon. This was blocked by CSP in staging/production because default-src didn't include data:. Added data: to default-src directive to fix favicon not updating in browser tabs when device status changes. --- CHANGELOG.txt | 7 +++++++ lib/towerops_web/plugs/security_headers.ex | 2 +- priv/static/changelog.txt | 1 + 3 files changed, 9 insertions(+), 1 deletion(-) diff --git a/CHANGELOG.txt b/CHANGELOG.txt index a95096f8..fed629a6 100644 --- a/CHANGELOG.txt +++ b/CHANGELOG.txt @@ -25,6 +25,13 @@ fix: access interface stats through latest_stat association - Fixes production 500 error on device detail page Files: lib/towerops_web/live/device_live/show.html.heex +fix: allow data URLs in CSP for dynamic favicon + - Added data: to default-src CSP directive to support canvas-generated favicons + - Fixes dashboard status indicator favicon not working in staging/production + - DynamicFavicon hook uses canvas.toDataURL() which requires data: URL support + - Some browsers don't treat as img-src, fall back to default-src +Files: lib/towerops_web/plugs/security_headers.ex + 2026-03-05 feat: add rate limiting to admin endpoints (100 req/min) - Add :admin type to RateLimit plug with 100 requests per minute per IP diff --git a/lib/towerops_web/plugs/security_headers.ex b/lib/towerops_web/plugs/security_headers.ex index 84dc758b..5deb72d1 100644 --- a/lib/towerops_web/plugs/security_headers.ex +++ b/lib/towerops_web/plugs/security_headers.ex @@ -26,7 +26,7 @@ defmodule ToweropsWeb.Plugs.SecurityHeaders do defp csp_header do Enum.join( [ - "default-src 'self'", + "default-src 'self' data:", "script-src 'self' 'unsafe-inline'", "style-src 'self' 'unsafe-inline' 'unsafe-hashes'", "img-src 'self' data: https:", diff --git a/priv/static/changelog.txt b/priv/static/changelog.txt index c7c35936..0239b72a 100644 --- a/priv/static/changelog.txt +++ b/priv/static/changelog.txt @@ -2,6 +2,7 @@ * Per-organization customization of free device limits and per-device pricing * Organization settings page now reflects custom billing terms when set * Fixed a crash on the device detail page when interface statistics were unavailable +* Fixed dashboard status indicator favicon not updating in browser tab 2026-03-05 — Security Enhancements * Enhanced security for API endpoints and file uploads