Files
Kevin L'Hereec 9702d24a01
Build & Deploy / build (push) Failing after 5s
Build & Deploy / docker (push) Skipped
fix: allow gstatic.com in CSP img-src for merchant favicons
The favicon service used to show a merchant's icon in the price
comparison UI (www.google.com/s2/favicons) redirects to Google's gstatic
CDN (t0-t3.gstatic.com), which wasn't allowlisted — CSP silently blocked
the redirected image request (reported by some browsers as an opaque
response block rather than a clear CSP violation), so the 'Compare
prices' cheapest-offer favicon never rendered.

Added https://*.gstatic.com to img-src.
2026-07-23 15:38:00 +02:00
..