Merge pull request #1001 from ensdomains/fix/safari-csp

fix: safari csp

Author: laurgk

functions/_middleware.ts

@@ -52,7 +52,7 @@ const staticHandler: PagesFunction = async ({ request, next, env }) => {
   return next()
 }
 
-const firefoxRewrite: PagesFunction = async ({ request, next }) => {
+const cspRewrite: PagesFunction = async ({ request, next }) => {
   const userAgent = request.headers.get('user-agent')?.toLowerCase()
   const response = await next()
 
@@ -64,6 +64,12 @@ const firefoxRewrite: PagesFunction = async ({ request, next }) => {
       .transform(response)
   }
 
+  // safari CSP exception
+  if (userAgent?.includes('safari/') && userAgent.includes('version/')) {
+    response.headers.set('Content-Security-Policy', cspOnlyFrameAncestors)
+    return response
+  }
+
   // default headers
   response.headers.set('Content-Security-Policy', cspWithFrameAncestors)
   return response
@@ -166,4 +172,4 @@ const pathRewriter: PagesFunction = async ({ request, next }) => {
   return next()
 }
 
-export const onRequest = [staticHandler, firefoxRewrite, pathRewriter]
+export const onRequest = [staticHandler, cspRewrite, pathRewriter]