-
Notifications
You must be signed in to change notification settings - Fork 2
Conversation
Added the 'self' source and removed 'https' and 'strict-dynamic' 'https' would allow scripts from any HTTPS source and 'strict-dynamic' doesn't work with SvelteKit yet
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
praise: thank you so much for taking this off of me and figuring out the CSP issue :)
src/app.html
Outdated
@@ -4,6 +4,7 @@ | |||
<meta charset="utf-8" /> | |||
<meta name="description" content="Listen to podcasts on the web, wherever!" /> | |||
<link rel="manifest" href="%svelte.assets%/manifest.json" /> | |||
<link rel="preconnect" href="https://sklgqhbbbhticzdgegcj.supabase.co" /> |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
issue: I don't think we should hard-code this
suggestion: in the app
layer, there are a few components that manage meta tags, perhaps you could move it there and use the value from the environment variable?
To use the environment variable
Deploying with
|
Latest commit: |
0591154
|
Status: | ✅ Deploy successful! |
Preview URL: | https://d49ed48d.cast-iu.pages.dev |
Codecov Report
@@ Coverage Diff @@
## main #200 +/- ##
=======================================
Coverage 71.54% 71.54%
=======================================
Files 66 66
Lines 629 629
Branches 162 162
=======================================
Hits 450 450
Misses 167 167
Partials 12 12 Continue to review full report at Codecov.
|
I enabled the CSP again but disabled the
strict-dymanic
source since SvelteKit doesn't support it properly yet (sveltejs/kit#3558).As for the
unused-javascript
issue, I disabled the assertion since it is mostly not in our control (and SvelteKit basically closed the issue aswontfix
- sveltejs/kit#1371). It might be possible to work around it (according to this Reddit comment), but it feels like a dirty hack, so I'd say it's good as it is now.Resolves #167