fix(docs): move the guide's scripts out of the page to satisfy the CSP - #12
Merged
Merged
Conversation
The site is served behind script-src 'self' https://static.cloudflareinsights.com with no 'unsafe-inline', so every inline <script> on the page was blocked. The theme toggle, the language toggle and the nav highlight all worked locally and did nothing at all on the published page — the console showed one CSP violation per script block. They now live in docs/guide.js, same origin, which 'self' allows. It is loaded from <head> without defer because the theme and language still have to be stamped on <html> before the first paint; everything that touches the DOM waits for DOMContentLoaded. The button labels moved into data- attributes on the buttons themselves. That keeps every piece of translated text in the HTML beside the rest of the translations, and it means the script file has no string that a change of wording would have to reach. Not fixed here, because it is not ours: Cloudflare injects its own inline script into the response, and the same policy blocks that too. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The published guide had every one of its scripts blocked. The theme toggle, the language toggle and the nav highlight worked locally and did nothing at all on
tooark.com.The policy
script-srchas no'unsafe-inline', so an inline<script>is refused. The console showed one violation per block:Note what the same policy does allow, because it shaped the fix:
style-srckeeps'unsafe-inline', so the page's inline<style>is fine, and Google Fonts are explicitly allowed for both the stylesheet and the font files. Only scripts had to move.The fix
All three blocks are now
docs/guide.js, same origin, which'self'permits.<head>withoutdefer, on purpose: theme and language still have to be stamped on<html>before the first paint or the page flashes the wrong one.DOMContentLoaded.node --check docs/guide.jspasses.The button labels moved into
data-attributes on the buttons. Soguide.jsnow contains no human-readable string at all — a wording change is a change to the HTML, next to the rest of the translations, and there is no second place for a translation to hide. It also sidesteps any question about the charset a.jsfile is served with.Not fixed, because it is not ours
The fourth violation in the console (
:2511) is an inline script Cloudflare injects into the response for its bot-detection platform. The same policy blocks it. Nothing in this repository produces or can suppress it — it would need a change on the Cloudflare side.Affected area(s)
docs/— onboarding guideConsumer impact
Checklist
node --check docs/guide.jspasses<script>left in the page./scripts/check-sync.shpassesCHANGELOG.mdupdated under[Unreleased]🤖 Generated with Claude Code