Ragnaroos opened a new pull request, #4028:
URL: https://github.com/apache/doris-website/pull/4028

   ## What changed
   
   - allow `https://agent.velodb.io` in the production `connect-src` CSP
   - apply the same allowlist entry to the shared English/Chinese `.htaccess` 
and the Japanese build `.htaccess`
   
   ## Why
   
   The Profile Analysis page introduced in #4025 calls the public analysis API 
at `https://agent.velodb.io`. The production website CSP did not include that 
origin, so browsers rejected the `fetch` before any network request reached the 
backend and the UI entered its recovery state.
   
   hCaptcha requests were unaffected because its domains were already allowed.
   
   ## Validation
   
   - confirmed both tracked `.htaccess` files include `https://agent.velodb.io` 
specifically in `connect-src`
   - `git diff --check upstream/master...HEAD`
   - verified the PR branch is based on the latest 
`apache/doris-website:master` and contains only the two CSP changes
   
   ## Follow-up verification
   
   After deployment, inspect the `Content-Security-Policy` response header on 
`https://doris.apache.org/profile-analysis` and confirm that `connect-src` 
contains `https://agent.velodb.io`.
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: [email protected]

For queries about this service, please contact Infrastructure at:
[email protected]


---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]

Reply via email to