From 4382ba5e172a383dfb4598a407fcab88e1a7e306 Mon Sep 17 00:00:00 2001 From: CarterPerez-dev Date: Sun, 17 May 2026 19:07:41 -0400 Subject: [PATCH] fix(canary): CSP allows challenges.cloudflare.com for Turnstile Audit F10: script-src 'self' blocked the Turnstile bootstrap script (https://challenges.cloudflare.com/turnstile/v0/api.js) and its widget iframe. Added challenges.cloudflare.com to script-src, connect-src, and a new frame-src directive so the widget can render under prod CSP. --- .../backend/internal/middleware/headers.go | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/PROJECTS/beginner/canary-token-generator/backend/internal/middleware/headers.go b/PROJECTS/beginner/canary-token-generator/backend/internal/middleware/headers.go index f138cc66..18014237 100644 --- a/PROJECTS/beginner/canary-token-generator/backend/internal/middleware/headers.go +++ b/PROJECTS/beginner/canary-token-generator/backend/internal/middleware/headers.go @@ -42,18 +42,19 @@ func SecurityHeaders(isProduction bool) func(http.Handler) http.Handler { func buildCSP(isProduction bool) string { directives := []string{ "default-src 'self'", - "script-src 'self'", + "script-src 'self' https://challenges.cloudflare.com", "style-src 'self' 'unsafe-inline'", "img-src 'self' data: https:", "font-src 'self'", - "connect-src 'self'", + "connect-src 'self' https://challenges.cloudflare.com", + "frame-src https://challenges.cloudflare.com", "frame-ancestors 'none'", "base-uri 'self'", "form-action 'self'", } if !isProduction { - directives[1] = "script-src 'self' 'unsafe-inline' 'unsafe-eval'" + directives[1] = "script-src 'self' 'unsafe-inline' 'unsafe-eval' https://challenges.cloudflare.com" } return strings.Join(directives, "; ")