fix: allow GitHub-hosted episode audio through CSP media-src#90
Merged
Conversation
… domain Connected cyberjus.org to the Vercel project today (A record @ -> 216.198.79.1, CNAME www -> Vercel's assigned target, both DNS-only on Cloudflare to avoid double-proxying the TLS handshake). Update the code-level fallback so metadataBase/OpenGraph/robots.txt/sitemap.xml resolve to the real domain without needing NEXT_PUBLIC_SITE_URL set as an env var.
Episode audio broke in production after the CSP added in the earlier security-headers pass: audio.src (contexts/AudioContext.tsx) points at github.com/.../releases/download/... and its release-assets.githubusercontent.com redirect target, but the CSP had no media-src directive, so it fell back to default-src 'self' and silently blocked every episode's audio in the browser - no network error, just a CSP violation and a stuck "loading" spinner. Verified locally: before the fix, `next start` + actually clicking play left the UI unresponsive; after adding media-src, clicking play flips the button to "Reproduzindo..." with zero console errors.
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Episode audio stopped working in production after the CSP added earlier this session (headers()) -
audio.srcincontexts/AudioContext.tsxpoints atgithub.com/.../releases/download/...(redirecting torelease-assets.githubusercontent.com), but the CSP had nomedia-srcdirective, so browsers fell back todefault-src 'self'and silently blocked it (CSP violation, not a network error - the player just spun forever).Fix: added
media-src 'self' https://github.com https://*.githubusercontent.comto the CSP innext.config.mjs.Test plan
next startwith the old CSP, clicking play never reached "playing" statemedia-src,curl -Ishows the header updated, and clicking play in the browser flips to "Reproduzindo..." with zero console errors