Add connect-src for cloudflareinsights.com to CSP

[fzipi]

Summary

• Add connect-src 'self' https://cloudflareinsights.com to the Content-Security-Policy in static/_headers
• The Cloudflare beacon script (already allowed under script-src) reports analytics via a fetch call to cloudflareinsights.com, which the CSP's connect-src did not previously allow

Test plan

• Deploy preview and confirm no CSP connect-src violations are reported in the browser console for the Cloudflare beacon

Summary by CodeRabbit

• Security
  • Updated content security settings to allow trusted connection telemetry while preserving existing script and framing protections.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 24d13711-60e5-4882-a567-fd87a90d0c1d

📥 Commits

Reviewing files that changed from the base of the PR and between 9fb2c08 and e4990e7.

📒 Files selected for processing (1)

• static/_headers

---

📝 Walkthrough

Walkthrough

The Content-Security-Policy header now explicitly permits connections to 'self' and https://cloudflareinsights.com, while retaining the existing script and frame ancestor directives.

Changes

Content-Security-Policy update

Layer / File(s)	Summary
Add CSP connection sources static/_headers	Adds an explicit connect-src directive allowing same-origin and Cloudflare Insights connections.

Estimated code review effort: 1 (Trivial) | ~2 minutes

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly matches the main change: adding a CSP connect-src entry for cloudflareinsights.com.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/csp-cloudflareinsights-connect-src

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[cloudflare-workers-and-pages]

Deploying website with    Cloudflare Pages

Latest commit:	e4990e7
Status:	✅  Deploy successful!
Preview URL:	https://b5debfa0.website-1u6.pages.dev
Branch Preview URL:	https://fix-csp-cloudflareinsights-c.website-1u6.pages.dev

View logs