fix: add CSP headers to allow connections to *.objectstack.ai domain#1149
fix: add CSP headers to allow connections to *.objectstack.ai domain#1149
Conversation
The CSP policy was blocking connections to https://demo.objectstack.ai because it only allowed https://*.objectstack.io. This adds explicit CSP headers in vercel.json to allow both *.objectstack.io and *.objectstack.ai domains in the connect-src directive. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com> Co-authored-by: hotlong <50353452+hotlong@users.noreply.github.com>
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
There was a problem hiding this comment.
Pull request overview
Adds a Vercel-level Content Security Policy for Studio to unblock client-side discovery/connection flows to *.objectstack.ai (in addition to existing *.objectstack.io) during initialization.
Changes:
- Adds a
Content-Security-Policyresponse header inapps/studio/vercel.json. - Extends
connect-srcto allowhttps://*.objectstack.ai. - Applies the header broadly via
source: "/(.*)".
| "headers": [ | ||
| { | ||
| "key": "Content-Security-Policy", | ||
| "value": "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.com; img-src 'self' data: blob: https:; connect-src 'self' ws: wss: http://localhost:* https://*.objectstack.io https://*.objectstack.ai https://*.sentry.io" |
There was a problem hiding this comment.
This CSP enables script-src 'unsafe-inline' and especially 'unsafe-eval', which significantly weakens XSS protections. If these aren’t strictly required, prefer a tighter policy (e.g., rely on default-src 'self' and only customize connect-src, or use nonces/hashes instead of unsafe-*).
| "value": "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.com; img-src 'self' data: blob: https:; connect-src 'self' ws: wss: http://localhost:* https://*.objectstack.io https://*.objectstack.ai https://*.sentry.io" | |
| "value": "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.com; img-src 'self' data: blob: https:; connect-src 'self' ws: wss: http://localhost:* https://*.objectstack.io https://*.objectstack.ai https://*.sentry.io" |
| }, | ||
| "headers": [ | ||
| { | ||
| "source": "/(.*)", |
There was a problem hiding this comment.
source: "/(.*)" applies the CSP header to every request (including /assets/* and /api/*). Consider scoping CSP to document routes only (e.g., exclude /assets/ and /api/ with a negative lookahead similar to the rewrite rule) to avoid adding CSP headers to non-document responses.
| "source": "/(.*)", | |
| "source": "/((?!api/|assets/).*)", |
Vercel deployment was blocking client connections to
https://demo.objectstack.ai/.well-known/objectstackwith CSP violation. The existing policy only allowed*.objectstack.iodomains.Changes
Content-Security-Policyheader inapps/studio/vercel.jsonconnect-srcdirective to includehttps://*.objectstack.aialongside existing*.objectstack.io/(.*)source patternCSP Policy
This allows the client discovery mechanism to probe both production (
.io) and demo (.ai) domains during connection initialization.