- Shipped
- August 3, 2026 at 4:26 AM UTC
- Author
- kamo
- Commit
- a5f4ef5
The policy was attached only at the final `NextResponse.next()`, so /logout and /validate — both real, browser-rendered documents — were served with no img-src at all, as was the 403 access-denied page. That gap is also what made my earlier verification useless: a probe that happened to hit one of those paths saw no header and I read it as the fail-open branch working correctly, when in fact the broken header was still live on every other page. /api/* is deliberately still excluded. Those responses are not documents, and two of them — /api/images/proxy and the sender-avatar byte route — set a far stricter per-response CSP of "default-src 'none'; sandbox". Applying the page policy there would overwrite it, loosening precisely the responses that carry foreign bytes. Also documents a pre-existing bug rather than fixing it: the access-rule check on the line below reads request.nextUrl.hostname, which behind Traefik is 127.0.0.1 and never the tenant domain — the same mistake that broke the image policy. Any host-scoped access rule has therefore been evaluated against "127.0.0.1" and has effectively never matched. Left alone on purpose: correcting it changes authorization rather than presentation, so rules that have been silently inert would begin enforcing on the next deploy and any misconfigured one would lock people out of their own org. It needs an audit of the configured rules first.