gitea-admin/gh-christianlouis-docuelevate
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat(ui): migrate Tailwind CSS from v2 CDN to v3 Play CDN (interim step)

Browse Source 
Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com>
Agent-Logs-Url: https://github.com/christianlouis/DocuElevate/sessions/85d2244d-170a-48d3-8f6b-b4c124a49ed9
This commit is contained in:
copilot-swe-agent[bot]
2026-03-22 17:50:11 +00:00
parent 48a303d498
commit 1d7df13c94
12 changed files with 20 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/ConfigurationGuide.md
+1 -1
View File
@@ -792,7 +792,7 @@ SECURITY_HEADER_CSP_VALUE="default-src 'self'; script-src 'self'; style-src 'sel
SECURITY_HEADER_CSP_VALUE="default-src 'self'; script-src 'self' https://cdn.example.com; style-src 'self' 'unsafe-inline';"
```
**Note:** The default policy includes `'unsafe-inline'` for compatibility with Tailwind CSS and inline JavaScript. For stricter security, use nonces or hashes.
**Note:** The default policy includes `'unsafe-inline'` and `https://cdn.tailwindcss.com` for compatibility with Tailwind CSS v3 Play CDN and inline JavaScript. For stricter security, use nonces or hashes.
#### X-Frame-Options
docs/ProductionReadiness.md
+2 -2
View File
@@ -157,10 +157,10 @@ Recommended headers to configure at the proxy level:
#### Content-Security-Policy Notes
DocuElevate's frontend uses Tailwind CSS loaded from CDN in development mode. In production, ensure your CSP allows loading scripts and styles from your configured static file origin. A starting point:
DocuElevate's frontend uses Tailwind CSS v3 Play CDN. In production, ensure your CSP allows loading scripts from `https://cdn.tailwindcss.com`. A starting point:
```
Content-Security-Policy: default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data:;
Content-Security-Policy: default-src 'self'; script-src 'self' 'unsafe-inline' https://cdn.tailwindcss.com; style-src 'self' 'unsafe-inline'; img-src 'self' data:;
```
Audit and tighten this policy for your specific deployment.