From 1e04258c226b3835274d710c9caebf916504706e Mon Sep 17 00:00:00 2001
From: MattNotarangelo <matt.notarangelo@rokt.com>
Date: Fri, 26 Jun 2026 18:42:50 -0700
Subject: [PATCH] fix(csp): allow Cloudflare Web Analytics beacon

The strict CSP (script-src 'self', connect-src 'self') blocked the
beacon that Cloudflare Pages auto-injects, so Web Analytics recorded
nothing. Allowlist the two beacon origins:
- script-src: https://static.cloudflareinsights.com (beacon.min.js)
- connect-src: https://cloudflareinsights.com (RUM /cdn-cgi/rum endpoint)

Comment updated to reflect the one permitted third-party dependency.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 index.html | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/index.html b/index.html
index 77c5869..a98ae0d 100644
--- a/index.html
+++ b/index.html
@@ -5,10 +5,12 @@
     <meta name="viewport" content="width=device-width, initial-scale=1.0" />
     <!-- Defense-in-depth: the app's only threat surface is file-derived content
          rendered into the DOM. A strict script-src blocks any injected script
-         even if escaping is ever incomplete. No third-party/network resources. -->
+         even if escaping is ever incomplete. The only permitted third-party
+         origins are Cloudflare Web Analytics (beacon script + RUM endpoint),
+         which Cloudflare Pages injects automatically. -->
     <meta
       http-equiv="Content-Security-Policy"
-      content="default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob:; connect-src 'self'; worker-src 'self' blob:; object-src 'none'; base-uri 'self'; form-action 'none'"
+      content="default-src 'self'; script-src 'self' https://static.cloudflareinsights.com; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob:; connect-src 'self' https://cloudflareinsights.com; worker-src 'self' blob:; object-src 'none'; base-uri 'self'; form-action 'none'"
     />
     <title>Cave Survey Viewer</title>
     <meta name="google-site-verification" content="yhJBw46UtDk7-YZn_gDqYoYJpHEHPOMHRE065-Nohf4" />