[site] Fix CSP violations on the 404 page - #877
Open
the-other-tim-brown wants to merge 1 commit into
Open
Conversation
The 404 page still loads three third-party resources that the ASF
Content-Security-Policy blocks, so in production it renders with a
broken illustration and console errors:
- ajax.googleapis.com WebFont loader (plus the fonts.googleapis.com /
fonts.gstatic.com preconnects) — the page has no Material Icons
ligatures on it at all, so this is dead weight regardless
- d3e54v103j8qbb.cloudfront.net for the "page not found" illustration
- d3e54v103j8qbb.cloudfront.net for jQuery
apache#764 removed exactly these from the home page, but it did so by deleting
static/404.html outright. apache#863 then reintroduced the page at
homepage/404.html from the pre-apache#764 Webflow export, which brought the
CDN references back with it.
Apply the same treatment apache#764 gave the home page: drop the font loader,
point jQuery at the copy already vendored in static/js/, and vendor the
754-byte illustration into static/images/. The page now loads entirely
from the site's own origin.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01CyVF3fyK2VQE7DPd31mRLv
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
The 404 page loads three third-party resources that the ASF Content-Security-Policy blocks. In production it renders with a broken illustration placeholder and console errors.
ajax.googleapis.com/.../webfont.js+WebFont.load(...)fonts.googleapis.com/fonts.gstatic.compreconnectsd3e54v103j8qbb.cloudfront.net/static/page-not-found...svgd3e54v103j8qbb.cloudfront.net/js/jquery-3.5.1.min...jsWhy it came back
#764 removed exactly these from the home page, but it did so by deleting
static/404.htmloutright. #863 then reintroduced the page athomepage/404.htmlfrom the pre-#764 Webflow export, which brought the CDN references back with it.Changes
Same treatment #764 gave the home page:
js/jquery-3.5.1.min.js, the copy [site] Fix CSP issues on the website #764 already vendored intostatic/js/.static/images/page-not-found.svg. Keeping it as a file rather than inlining it means no layout change, no new CSS, and no inlinestyleattribute. RAT excludes**/website/**andGithub.svg/linkedin.svg/twitter.svgalready ship without headers, so this matches existing practice.The page now loads entirely from the site's own origin — the only remaining
httpstring in the file is the Webflow attribution comment on line 1.Testing
npm run build && npm run serve, then requested a nonexistent path:page-not-found.svgwith nocloudfrontreferences in the outputcss/normalize.css,css/webflow.css,css/onetable-ad267e.webflow.css,images/xtable-favicon.png,images/page-not-found.svg,js/jquery-3.5.1.min.js,js/webflow.jsNote, not fixed here
Both
homepage/404.html:16andhomepage/index.html:23referenceimages/webclip.pngas theirapple-touch-icon, but that file was deleted in 62ca0c0 ("removed unused images"). It 404s on both pages. Not a CSP issue and it affects the home page equally, so it seemed better left to its own change.🤖 Generated with Claude Code
https://claude.ai/code/session_01CyVF3fyK2VQE7DPd31mRLv