Expand CSP to fully support Cloudflare Turnstile

abhivaikar · claude · abhivaikar · commit a76544dfd5ae · 2025-12-01T22:55:04.000+08:00
Updated Content-Security-Policy to include: - Wildcard for all Cloudflare subdomains (*.cloudflare.com) - frame-src for Turnstile challenge frames - Broader connect-src to allow all Turnstile API calls - img-src for CAPTCHA images This should resolve the "Failed to fetch" error. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com>
diff --git a/app/layout.tsx b/app/layout.tsx
@@ -30,7 +30,7 @@ export default function RootLayout({
       <head>
         <meta
           httpEquiv="Content-Security-Policy"
-          content="script-src 'self' 'unsafe-inline' 'unsafe-eval' https://challenges.cloudflare.com; connect-src 'self' https://challenges.cloudflare.com;"
+          content="default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://challenges.cloudflare.com https://*.cloudflare.com; style-src 'self' 'unsafe-inline'; connect-src 'self' https://challenges.cloudflare.com https://*.cloudflare.com; frame-src https://challenges.cloudflare.com; img-src 'self' data: https:;"
         />
       </head>
       <body className="antialiased">
