This is an automated email from the ASF dual-hosted git repository.
morningman pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/doris-website.git
The following commit(s) were added to refs/heads/master by this push:
new 3862366cf44 [fix] Allow profile analysis API in CSP (#4028)
3862366cf44 is described below
commit 3862366cf4454671eee82a75fa0736f0a85b6ca5
Author: Mairui Li <[email protected]>
AuthorDate: Fri Jul 31 21:27:35 2026 +0800
[fix] Allow profile analysis API in CSP (#4028)
## What changed
- allow `https://agent.velodb.io` in the production `connect-src` CSP
- apply the same allowlist entry to the shared English/Chinese
`.htaccess` and the Japanese build `.htaccess`
## Why
The Profile Analysis page introduced in #4025 calls the public analysis
API at `https://agent.velodb.io`. The production website CSP did not
include that origin, so browsers rejected the `fetch` before any network
request reached the backend and the UI entered its recovery state.
hCaptcha requests were unaffected because its domains were already
allowed.
## Validation
- confirmed both tracked `.htaccess` files include
`https://agent.velodb.io` specifically in `connect-src`
- `git diff --check upstream/master...HEAD`
- verified the PR branch is based on the latest
`apache/doris-website:master` and contains only the two CSP changes
## Follow-up verification
After deployment, inspect the `Content-Security-Policy` response header
on `https://doris.apache.org/profile-analysis` and confirm that
`connect-src` contains `https://agent.velodb.io`.
---
ja-build/.htaccess | 2 +-
static/.htaccess | 2 +-
2 files changed, 2 insertions(+), 2 deletions(-)
diff --git a/ja-build/.htaccess b/ja-build/.htaccess
index 97a152dbe41..282efe9f9b5 100644
--- a/ja-build/.htaccess
+++ b/ja-build/.htaccess
@@ -1,3 +1,3 @@
<IfModule mod_headers.c>
- Header set Content-Security-Policy "script-src 'self' widget.kapa.ai
www.google.com https://hcaptcha.com https://*.hcaptcha.com
https://www.gstatic.com 'unsafe-inline' 'unsafe-eval'; connect-src 'self'
proxy.kapa.ai kapa-widget-proxy-la7dkmplpq-uc.a.run.app metrics.kapa.ai
https://hcaptcha.com https://*.hcaptcha.com www.google.com; frame-src 'self'
www.google.com https://hcaptcha.com https://*.hcaptcha.com; style-src 'self'
'unsafe-inline' https://hcaptcha.com https://*.hcaptcha.com;";
+ Header set Content-Security-Policy "script-src 'self' widget.kapa.ai
www.google.com https://hcaptcha.com https://*.hcaptcha.com
https://www.gstatic.com 'unsafe-inline' 'unsafe-eval'; connect-src 'self'
proxy.kapa.ai kapa-widget-proxy-la7dkmplpq-uc.a.run.app metrics.kapa.ai
https://hcaptcha.com https://*.hcaptcha.com www.google.com
https://agent.velodb.io; frame-src 'self' www.google.com https://hcaptcha.com
https://*.hcaptcha.com; style-src 'self' 'unsafe-inline' https://hcaptcha.com
[...]
</IfModule>
diff --git a/static/.htaccess b/static/.htaccess
index 05729db56a6..342ab5ed593 100644
--- a/static/.htaccess
+++ b/static/.htaccess
@@ -1,5 +1,5 @@
<IfModule mod_headers.c>
- Header set Content-Security-Policy "script-src 'self'
https://cdnd.selectdb.com https://analytics.apache.org widget.kapa.ai
www.google.com https://hcaptcha.com https://*.hcaptcha.com
https://www.gstatic.com 'unsafe-inline' 'unsafe-eval'; connect-src 'self'
https://analytics.apache.org proxy.kapa.ai
kapa-widget-proxy-la7dkmplpq-uc.a.run.app metrics.kapa.ai https://hcaptcha.com
https://*.hcaptcha.com www.google.com; frame-src 'self' www.google.com
https://hcaptcha.com https://*.hcaptch [...]
+ Header set Content-Security-Policy "script-src 'self'
https://cdnd.selectdb.com https://analytics.apache.org widget.kapa.ai
www.google.com https://hcaptcha.com https://*.hcaptcha.com
https://www.gstatic.com 'unsafe-inline' 'unsafe-eval'; connect-src 'self'
https://analytics.apache.org proxy.kapa.ai
kapa-widget-proxy-la7dkmplpq-uc.a.run.app metrics.kapa.ai https://hcaptcha.com
https://*.hcaptcha.com www.google.com https://agent.velodb.io; frame-src 'self'
www.google.com https://hcaptc [...]
</IfModule>
# Legacy /docs/dev/* paths whose 1:1 target was retired (renamed slugs, removed
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
