From ba73af8ced46f1d2bd56055775953141645df28b Mon Sep 17 00:00:00 2001 From: bruno Date: Wed, 29 Jul 2026 21:14:36 -0400 Subject: [PATCH] fix: CSP font-src blocks Excalidraw fonts from esm.sh MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit CSP directive 'font-src' only allowed self, data:, and fonts.gstatic.com. Excalidraw loads its handwriting fonts (*.woff2) from esm.sh via EXCALIDRAW_ASSET_PATH. All ~12 font files were blocked (blocked:csp) → Excalidraw fails to initialize → infinite 'Loading...' spinner. Fix: added https://esm.sh to font-src directive. --- backend/main.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/backend/main.py b/backend/main.py index 6cffc0f..a3a4af7 100644 --- a/backend/main.py +++ b/backend/main.py @@ -575,7 +575,7 @@ class SecurityHeadersMiddleware(BaseHTTPMiddleware): "style-src 'self' 'unsafe-inline' https://cdnjs.cloudflare.com https://fonts.googleapis.com https://cdn.jsdelivr.net; " "img-src 'self' data: blob:; " "connect-src 'self' blob: https://esm.sh https://unpkg.com https://cdnjs.cloudflare.com https://fonts.googleapis.com https://fonts.gstatic.com https://cdn.jsdelivr.net; " - "font-src 'self' data: https://fonts.gstatic.com; " + "font-src 'self' data: https://fonts.gstatic.com https://esm.sh; " "worker-src 'self' blob:; " "frame-src 'self' blob:;" )