From 2d259a2b7c7441197ab3b24f1b00ef82c527b0da Mon Sep 17 00:00:00 2001 From: cclohmar Date: Mon, 1 Jun 2026 23:51:39 +0000 Subject: [PATCH] fix: add 'unsafe-inline' to script-src CSP so onclick handlers work --- main.go | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/main.go b/main.go index 7003d1a..9b8a30a 100644 --- a/main.go +++ b/main.go @@ -133,7 +133,7 @@ func main() { w.Header().Set("X-Frame-Options", "DENY") w.Header().Set("Referrer-Policy", "strict-origin-when-cross-origin") w.Header().Set("Content-Security-Policy", - "default-src 'self'; img-src 'self' data:; script-src 'self' https://unpkg.com/htmx.org@1.9.10; style-src 'self' 'unsafe-inline'") + "default-src 'self'; img-src 'self' data:; script-src 'self' https://unpkg.com/htmx.org@1.9.10 'unsafe-inline'; style-src 'self' 'unsafe-inline'") next.ServeHTTP(w, r) }) })