fix(csp): allow blocked inline style via SHA-256 hash in style-src (#43)

Copilot · RMCampos · web-flow · commit 39e5ac5b423e · 2026-05-06T18:37:02.000-03:00
* Initial plan * fix: add CSP hash for blocked inline style in style-src directive Agent-Logs-Url: https://github.com/RMCampos/tasknote/sessions/a51fd5ff-eb93-4ef0-96e0-3d10df540a59 Co-authored-by: RMCampos <2219519+RMCampos@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: RMCampos <2219519+RMCampos@users.noreply.github.com>
diff --git a/client/Caddyfile b/client/Caddyfile
@@ -34,7 +34,7 @@
       media-src 'self';
       object-src 'none';
       script-src 'unsafe-inline' 'report-sample' 'self' https://*.cloudfront.net;
-      style-src 'report-sample' 'self' https://cdn.jsdelivr.net/ https://fonts.googleapis.com;
+      style-src 'report-sample' 'self' https://cdn.jsdelivr.net/ https://fonts.googleapis.com 'sha256-+OsIn6RhyCZCUkkvtHxFtP0kU3CGdGeLjDd9Fzqdl3o=';
       worker-src 'none';
     "
     Referrer-Policy "same-origin"

Original file line number	Diff line number	Diff line change
`@@ -34,7 +34,7 @@`
`34`	`34`	`media-src 'self';`
`35`	`35`	`object-src 'none';`
`36`	`36`	`script-src 'unsafe-inline' 'report-sample' 'self' https://*.cloudfront.net;`
`37`		`- style-src 'report-sample' 'self' https://cdn.jsdelivr.net/ https://fonts.googleapis.com;`
	`37`	`+ style-src 'report-sample' 'self' https://cdn.jsdelivr.net/ https://fonts.googleapis.com 'sha256-+OsIn6RhyCZCUkkvtHxFtP0kU3CGdGeLjDd9Fzqdl3o=';`
`38`	`38`	`worker-src 'none';`
`39`	`39`	`"`
`40`	`40`	`Referrer-Policy "same-origin"`