From a2ad25cc75f026bc5c563597da350347b2a7e0a9 Mon Sep 17 00:00:00 2001 From: ribeirogab Date: Sun, 4 Oct 2026 21:14:39 -0300 Subject: [PATCH] fix: stop Cloudflare from injecting scripts into the landing page Cloudflare injected its Web Analytics script into the HTML, which the Content Security Policy blocked with a console error. Every response now sends Cache-Control: no-transform, so Cloudflare leaves the HTML as built. Hashed files under /assets/ keep a one-year immutable cache. --- docs/development.md | 2 +- site/public/_headers | 4 +++- 2 files changed, 4 insertions(+), 2 deletions(-) diff --git a/docs/development.md b/docs/development.md index 15dceca..4cb4e9a 100644 --- a/docs/development.md +++ b/docs/development.md @@ -104,7 +104,7 @@ To publish the page, sign in once with `pnpm exec wrangler login`, using the Clo pnpm site:deploy ``` -The command builds the site and deploys it as a Cloudflare Worker with static assets (`wrangler.jsonc`). The Worker serves `github-file-hider.ribeiro.engineer` as a custom domain, so Cloudflare manages its DNS record and certificate. `site/public/_headers` sets the security and cache headers. +The command builds the site and deploys it as a Cloudflare Worker with static assets (`wrangler.jsonc`). The Worker serves `github-file-hider.ribeiro.engineer` as a custom domain, so Cloudflare manages its DNS record and certificate. `site/public/_headers` sets the security and cache headers. `Cache-Control: no-transform` on every response stops Cloudflare from changing the HTML, for example to inject its Web Analytics script, which the Content Security Policy would block. ## Manual test on the demo repository diff --git a/site/public/_headers b/site/public/_headers index c3fb957..16d3976 100644 --- a/site/public/_headers +++ b/site/public/_headers @@ -4,6 +4,8 @@ Referrer-Policy: strict-origin-when-cross-origin Permissions-Policy: camera=(), microphone=(), geolocation=(), payment=(), usb=() Cross-Origin-Opener-Policy: same-origin + Cache-Control: public, max-age=0, must-revalidate, no-transform /assets/* - Cache-Control: public, max-age=31536000, immutable + ! Cache-Control + Cache-Control: public, max-age=31536000, immutable, no-transform