feat(ci): add CSP, HSTS headers and PR preview deployments - #3
Conversation
- Add Content-Security-Policy header allowing PostHog and inline scripts - Add HSTS header (1 year, includeSubDomains) - Fix _headers file order (specific paths first, global rules last) - Add PR preview deployment workflow with comment on PRs - Add deployment URL output to GitHub Actions summary - Add /_astro/* cache rules for Astro hashed assets Co-Authored-By: Claude <noreply@anthropic.com>
✅ Deploy Preview for soumyo-dey ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
Preview Deployment Ready!Preview URL: https://24811bed.soumyo-com.pages.dev This preview will be automatically updated when you push new commits. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 4693bf365d
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| Permissions-Policy: camera=(), microphone=(), geolocation=() | ||
| Content-Security-Policy: default-src 'self'; script-src 'self' 'unsafe-inline' https://us.i.posthog.com; style-src 'self' 'unsafe-inline'; img-src 'self' data: https:; font-src 'self' data:; connect-src 'self' https://us.i.posthog.com; frame-ancestors 'none'; base-uri 'self'; form-action 'self' |
There was a problem hiding this comment.
The CSP hardcodes https://us.i.posthog.com for both script-src and connect-src, but the site’s PostHog host is configurable via PUBLIC_POSTHOG_HOST (see src/components/posthog.astro). If that env var is set to a non‑US or self‑hosted domain (e.g. https://eu.i.posthog.com), the browser will block loading /static/array.js and API calls, so analytics silently fails. Consider generating the CSP from the same configured host or allowing the alternative hosts you support.
Useful? React with 👍 / 👎.
1 participant
Summary
This PR improves the Cloudflare Pages deployment setup to follow security best practices:
_headersfile to have specific paths first, global rules last (per Cloudflare best practices)Changes
scripts/generate-headers.js.github/workflows/deploy.yml.github/workflows/preview.ymlCSP Policy Details
Testing
bun run build)_headersfile generated correctlyWhat's NOT included
preloaddirective for HSTS (requires hstspreload.org submission, irreversible)_redirectsfile (www redirect handled by Cloudflare Bulk Redirects, Astro handles trailing slashes)Generated with Claude Code