chore(entry.server): only upgrade-insecure-requests if production a…

…nd host isnt localhost Signed-off-by: Logan McAnsh <logan@mcan.sh>
mcansh · Dec 6, 2024 · b8407b8 · b8407b8
1 parent b13da14
commit b8407b8
Show file tree

Hide file tree

Showing 2 changed files with 4 additions and 1 deletion.
diff --git a/app/entry.server.tsx b/app/entry.server.tsx
@@ -116,7 +116,9 @@ function applySecurityHeaders(request: Request, responseHeaders: Headers) {
 	let nonce = createNonce();
 	let securityHeaders = createSecureHeaders({
 		"Content-Security-Policy": {
-			"upgrade-insecure-requests": process.env.NODE_ENV === "production",
+			"upgrade-insecure-requests":
+				process.env.NODE_ENV === "production" &&
+				!url.host.includes("localhost"),
 			"default-src": ["'none'"],
 			"base-uri": ["'self'"],
 			"img-src": [

diff --git a/package.json b/package.json
@@ -20,6 +20,7 @@
 		"prepare": "node ./scripts/prepare.js",
 		"dev": "cross-env NODE_ENV=development node --watch-path ./server.js ./server.js",
 		"start": "cross-env NODE_ENV=production node ./server.js",
+		"start:local": "cross-env NODE_ENV=production node --env-file=./.env ./server.js",
 		"knip": "knip-bun"
 	},
 	"dependencies": {