Csp - Tag - arleo.euhttps://www.arleo.eu/en/tags/csp/Csp - Tag - arleo.euHugo -- gohugo.ioenFri, 29 May 2026 20:00:00 +0200Hugo: freezing Mermaid diagrams to static dark/light SVGshttps://www.arleo.eu/en/posts/debug-mermaid-svg-freeze/Fri, 29 May 2026 20:00:00 +0200Jmrhttps://www.arleo.eu/en/posts/debug-mermaid-svg-freeze/

Problem

Mermaid diagrams on arleo.eu were rendering client-side via cdn.jsdelivr.net. Three concrete consequences:

  1. CSP constraint — script-src cdn.jsdelivr.net and worker-src cdn.jsdelivr.net become mandatory (Mermaid v11 uses Web Workers for its parsers).
  2. Render flash — the diagram appears after JS execution, creating a visible delay.
  3. Dark theme ignored — Mermaid initialized the SVG in light mode even when the site theme was dark.

The solution: generate SVGs at build time with mmdc, outside any browser context.

]]>CSP A+ on Hugo + Cloudflare: from hash-based to origin allowlist, auto-monitoring and hardeninghttps://www.arleo.eu/en/posts/csp-a-plus-hugo-cloudflare-origin-allowlist/Thu, 28 May 2026 23:45:41 +0200Jmrhttps://www.arleo.eu/en/posts/csp-a-plus-hugo-cloudflare-origin-allowlist/

Context

arleo.eu runs on Hugo (KVM VM) → OpenResty (NUC) → Cloudflare (CDN/WAF). Goal: A+ score on Mozilla Observatory with a strict CSP that resists edge-side injections.

The journey went through three strategies over a few weeks — nonces, hashes, then origin allowlist — before landing on a stable, automated solution.

Act 1: why hash-based failed

The initial idea seemed solid: Hugo Pipes externalizes all JS with SRI, we list the hashes in the CSP, clean result. In practice, two problems made the approach impossible.

]]>CSP Hash on Hugo: migrating from nonce to hash to preserve CDN cachehttps://www.arleo.eu/en/posts/csp-hash-hugo/Sat, 16 May 2026 00:00:00 +0000Jmrhttps://www.arleo.eu/en/posts/csp-hash-hugo/<div class="featured-image"> <img src="/images/csp-hash-hugo-featured.png" referrerpolicy="no-referrer"> </div>CSP nonces and CDN caching are incompatible by design. On a Hugo static site, SHA-256 hashes are the native approach: computed at build time, stable across requests, and fully compatible with Cloudflare caching.