content security issue

[shawngraham]

Hi,

I'm having trouble deploying to netlify. I haven't changed anything, but when the site deploys, all the css, js, etc, all are being blocked:

Content Security Policy: The page’s settings blocked the loading of a resource at https://doks.netlify.app/main.a5cbcefa21402b16404e18b8364d2834d890c8107e3567d2e8c21b953bd3eaec69f89ea1fa3681c2012c0479b7fa4511bdfc0695273e2ea63c1b5bd7cf35cefa.css (“style-src”).

I haven't customized anything or otherwise messed with the innards of the site; I was just following the quick start. The index.headers file is:

/*
  Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
  X-Content-Type-Options: nosniff
  X-XSS-Protection: 1; mode=block
  Content-Security-Policy: default-src 'self'; frame-ancestors https://jamstackthemes.dev; manifest-src 'self'; connect-src 'self'; font-src 'self'; img-src 'self' data:; script-src 'self'; style-src 'self' 
  X-Frame-Options: SAMEORIGIN
  Referrer-Policy: strict-origin
  Feature-Policy: geolocation 'self'
  Cache-Control: public, max-age=31536000

Guidance greatly appreciated.

[shawngraham]

Ok, just noticed the config file in the 'production' folder. Changed baseurl there to my deploy, and that resolved my issue. Took a long friggin time to spot that!

[h-enk]

Took a long friggin time to spot that!

@shawngraham, sorry about that! I've added an alert to the documentation (Deployment + 6. Deploy Your Site):

[genebean]

Any tips for handling this when using Netlify deploy previews?

[h-enk]

Should work out of the box with these settings: https://github.com/h-enk/doks/blob/master/netlify.toml#L12-L13

Note, only set baseURL (your production URL) in ./config/_default/config.toml (so — in stead of my remark above — you do not have to set anything in ./config/production/config.toml — Hugo is smart enough to pick the right URL for the development environment)