nico Comments - Answer Overflow

nico

Explore posts from servers

•Created by nico on 3/8/2025 in #pages-help

Issue with WebP Image Styling on Cloudflare Pages Deployment

was related to the nuxt tailwindcss module in combination with cloudflare, fixed through the newest tailwind nuxt module version

2 replies

NNuxt

•Created by nico on 3/8/2025 in #❓・help

WebP Styling Issues on Cloudflare Pages (Nuxt 3, cloudflare_pages preset)

* Mirage and Rocket Loader are disabled. And Email Address Obfuscation also. * I am not using the Nuxt Image module. * And I am not using the h3-compression package (neither direct nor listed in my lockfile) * I dont want to use the CDN of Cloudflare

6 replies

CDCloudflare Developers

•Created by nico on 2/9/2025 in #pages-help

Missing Content-Security-Policy & Permissions-Policy Headers on Cloudflare Pages Deployment

Anyone?

4 replies

CDCloudflare Developers

•Created by nico on 2/9/2025 in #pages-help

Missing Content-Security-Policy & Permissions-Policy Headers on Cloudflare Pages Deployment

Shown (and somehow duplicated) _headers content in Dashboard:

/_scripts/*
  cache-control: public, max-age=31536000, immutable
/_nuxt/*
  cache-control: public, max-age=31536000, immutable
/*
  Content-Security-Policy: default-src 'self'; script-src 'self' 'nonce-{{nonce}}' https://static.cloudflareinsights.com https://challenges.cloudflare.com; frame-src 'self' https://challenges.cloudflare.com; img-src 'self' data: https://*.dashio.net; connect-src 'self' https://*.cloudflare.com https://cloudflareinsights.com https://*.dashio.net https://*.supabase.co; style-src 'self' 'unsafe-inline'; font-src 'self' data:; object-src 'none'; script-src-attr 'none'; base-uri 'none'; form-action 'self'; upgrade-insecure-requests
  Permissions-Policy: geolocation=(), microphone=(), camera=()
  Referrer-Policy: no-referrer
  Strict-Transport-Security: max-age=31536000; includeSubDomains; preload;
  X-Content-Type-Options: nosniff
  X-Download-Options: noopen
  X-Frame-Options: DENY
  X-Permitted-Cross-Domain-Policies: none
  X-XSS-Protection: 0

/_scripts/*
  cache-control: public, max-age=31536000, immutable
/_nuxt/*
  cache-control: public, max-age=31536000, immutable
/*
  Referrer-Policy: no-referrer
  Strict-Transport-Security: max-age=31536000; includeSubDomains; preload;
  X-Content-Type-Options: nosniff
  X-Download-Options: noopen
  X-Frame-Options: DENY
  X-Permitted-Cross-Domain-Policies: none
  X-XSS-Protection: 0

/_scripts/*
  cache-control: public, max-age=31536000, immutable
/_nuxt/*
  cache-control: public, max-age=31536000, immutable
/*
  Content-Security-Policy: default-src 'self'; script-src 'self' 'nonce-{{nonce}}' https://static.cloudflareinsights.com https://challenges.cloudflare.com; frame-src 'self' https://challenges.cloudflare.com; img-src 'self' data: https://*.dashio.net; connect-src 'self' https://*.cloudflare.com https://cloudflareinsights.com https://*.dashio.net https://*.supabase.co; style-src 'self' 'unsafe-inline'; font-src 'self' data:; object-src 'none'; script-src-attr 'none'; base-uri 'none'; form-action 'self'; upgrade-insecure-requests
  Permissions-Policy: geolocation=(), microphone=(), camera=()
  Referrer-Policy: no-referrer
  Strict-Transport-Security: max-age=31536000; includeSubDomains; preload;
  X-Content-Type-Options: nosniff
  X-Download-Options: noopen
  X-Frame-Options: DENY
  X-Permitted-Cross-Domain-Policies: none
  X-XSS-Protection: 0

/_scripts/*
  cache-control: public, max-age=31536000, immutable
/_nuxt/*
  cache-control: public, max-age=31536000, immutable
/*
  Referrer-Policy: no-referrer
  Strict-Transport-Security: max-age=31536000; includeSubDomains; preload;
  X-Content-Type-Options: nosniff
  X-Download-Options: noopen
  X-Frame-Options: DENY
  X-Permitted-Cross-Domain-Policies: none
  X-XSS-Protection: 0

What I've Tried: 1. Verified that _headers is included in the deployment (it's visible in the Cloudflare Pages build logs and dashboard as shown above). 2. Checked the security headers report using securityheaders.com, which still shows missing CSP and Permissions-Policy headers. 3. Confirmed that Cloudflare Pages does apply other headers (e.g., Strict-Transport-Security, X-Frame-Options, etc.). 4. Cleared Cloudflare Cache and redeployed multiple times. 5. Checked Firefox DevTools → Network tab → Security headers are missing in the final response. Questions: 1. Does Cloudflare Pages override or ignore certain headers from _headers? 2. Are there any known limitations when using _headers for CSP and Permissions-Policy? 3. Is there a recommended way to debug why these specific headers are not applied, even though others are? Any guidance would be greatly appreciated! Thanks in advance.

4 replies

NNuxt

•Created by nico on 3/29/2024 in #❓・help

Resolving TS2307 Error for Dynamic Component Imports in Nuxt 3