Ragnaroos opened a new pull request, #4028: URL: https://github.com/apache/doris-website/pull/4028
## What changed - allow `https://agent.velodb.io` in the production `connect-src` CSP - apply the same allowlist entry to the shared English/Chinese `.htaccess` and the Japanese build `.htaccess` ## Why The Profile Analysis page introduced in #4025 calls the public analysis API at `https://agent.velodb.io`. The production website CSP did not include that origin, so browsers rejected the `fetch` before any network request reached the backend and the UI entered its recovery state. hCaptcha requests were unaffected because its domains were already allowed. ## Validation - confirmed both tracked `.htaccess` files include `https://agent.velodb.io` specifically in `connect-src` - `git diff --check upstream/master...HEAD` - verified the PR branch is based on the latest `apache/doris-website:master` and contains only the two CSP changes ## Follow-up verification After deployment, inspect the `Content-Security-Policy` response header on `https://doris.apache.org/profile-analysis` and confirm that `connect-src` contains `https://agent.velodb.io`. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
