Gronod 3c3382401c fix: remove nonce from <link> tags — breaks CSS on mobile/caching proxies ...

style-src 'self' already permits same-origin stylesheets without a nonce.
Injecting a nonce onto <link rel=stylesheet> causes silent CSS failure on
mobile Safari and any setup where a caching proxy serves stale HTML (the
nonce in the HTML no longer matches the per-request CSP header nonce).

Nonce injection is now limited to <script> tags only, where it is
actually required to permit the same-origin app.js.

2026-05-17 09:28:44 +01:00

..

middleware

feat(security): production hardening for external deployment

2026-05-17 06:47:25 +01:00

routes

feat: replace client polling with Server-Sent Events (SSE)

2026-05-17 08:35:22 +01:00

utils

fix: correct status panel cache stats and static asset caching

2026-05-17 08:46:55 +01:00

app.js

fix: allow inline style= attributes via CSP style-src-attr

2026-05-17 08:53:07 +01:00

index.js

fix: remove nonce from <link> tags — breaks CSS on mobile/caching proxies

2026-05-17 09:28:44 +01:00