ulivargas/classroomio
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(dashboard): stop ERR_CONTENT_DECODING_FAILED on auth/proxy (#779)

Browse Source 
* fix(dashboard): prevent ERR_CONTENT_DECODING_FAILED on API proxy

Node fetch decompresses gzip/br upstream bodies while leaving
Content-Encoding set, so browsers fail auth/proxy responses with
net::ERR_CONTENT_DECODING_FAILED. Request identity encoding and strip
encoding headers from proxied responses. Also allow data: fonts in CSP
and skip UserJot on self-hosted.

Co-authored-by: Rotimi Best <rotimi-best@users.noreply.github.com>

* fix(dashboard): preserve Set-Cookie and use Jest for proxy tests

Copy Set-Cookie via getSetCookie/append so multi-cookie auth responses
are not collapsed on Expires commas. Convert proxy tests to Jest and
add CSP domain normalization coverage.

Co-authored-by: Rotimi Best <rotimi-best@users.noreply.github.com>

---------

Co-authored-by: Cursor Agent <cursoragent@cursor.com>
Co-authored-by: Rotimi Best <rotimi-best@users.noreply.github.com>
This commit is contained in:
Rotimi Best
2026-07-23 17:43:52 +01:00
committed by GitHub
co-authored by Rotimi Best Cursor Agent
parent b599f1a017
commit 2ceafcc6d1
7 changed files with 236 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
apps/dashboard/svelte.config.js
+3 -2
View File
@@ -38,7 +38,8 @@ const config = {
'script-src': ['self', ...csp.scriptSrc, 'unsafe-hashes', 'unsafe-eval'],
'style-src': ['self', 'unsafe-inline', ...csp.styleSrc],
'style-src-elem': ['self', 'unsafe-inline', ...csp.styleSrc],
'font-src': ['self', ...csp.fontSrc],
// data: covers inlined woff2 (e.g. PDF.js / icon fonts); file fonts use 'self'
'font-src': ['self', 'data:', ...csp.fontSrc],
'img-src': ['self', 'data:', ...csp.mediaSrc, 'blob:', 'http://localhost:9000'],
'media-src': [
'self',
@@ -70,7 +71,7 @@ const config = {
'script-src': ['self', ...csp.scriptSrc, 'unsafe-hashes', 'unsafe-eval'],
'style-src': ['self', 'unsafe-inline', ...csp.styleSrc],
'style-src-elem': ['self', 'unsafe-inline', ...csp.styleSrc],
'font-src': ['self', ...csp.fontSrc],
'font-src': ['self', 'data:', ...csp.fontSrc],
'img-src': ['self', 'data:', ...csp.mediaSrc, 'blob:', 'http://localhost:9000'],
'media-src': [
'self',