Changeset c869272 in Klonkt for src/middleware

Timestamp:

06/14/2026 06:16:58 PM (3 months ago)

Author:

roboburr <roboburr@…>

Branches:

main

Children:

5e95aac

Parents:

8afbdd6

Message:

fix: allow inline event handlers (CSP) — avatar upload + role dropdown were not working

Helmet's default set script-src-attr to 'none', blocking ALL inline event
handlers. As a result, <input onchange="this.form.submit()"> on the avatar
upload (and the role <select>) did nothing: choosing a file did not fire a
submit. Now script-src-attr 'unsafe-inline', consistent with the already
permitted inline <script> (script-src 'unsafe-inline').

Co-Authored-By: Claude <noreply@…>

(No files)