From 9702d24a01300d85123faf198ed3f72617cc02b4 Mon Sep 17 00:00:00 2001 From: Kevin L'Hereec Date: Thu, 23 Jul 2026 15:38:00 +0200 Subject: [PATCH] fix: allow gstatic.com in CSP img-src for merchant favicons MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The favicon service used to show a merchant's icon in the price comparison UI (www.google.com/s2/favicons) redirects to Google's gstatic CDN (t0-t3.gstatic.com), which wasn't allowlisted — CSP silently blocked the redirected image request (reported by some browsers as an opaque response block rather than a clear CSP violation), so the 'Compare prices' cheapest-offer favicon never rendered. Added https://*.gstatic.com to img-src. --- config/shield.ts | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) diff --git a/config/shield.ts b/config/shield.ts index 3f37be4..dd3346e 100644 --- a/config/shield.ts +++ b/config/shield.ts @@ -41,7 +41,17 @@ const shieldConfig = defineConfig({ // (lost TuyauProvider context after a failed hot reload). workerSrc: [`'self'`, 'blob:'], styleSrc: [`'self'`, `'unsafe-inline'`, 'https://fonts.googleapis.com'], - imgSrc: [`'self'`, 'data:', 'https://fr.pc-builder.io', 'https://www.google.com'], + // The favicon service (used to show a merchant's icon in the price + // comparison UI) is requested from www.google.com but actually + // serves/redirects to Google's gstatic CDN (t0-t3.gstatic.com), + // hence the wildcard. + imgSrc: [ + `'self'`, + 'data:', + 'https://fr.pc-builder.io', + 'https://www.google.com', + 'https://*.gstatic.com', + ], fontSrc: [`'self'`, 'data:', 'https://fonts.gstatic.com'], },