diff options
| author | Leitwolf11 | 2026-11-06 09:30:09 +0300 |
|---|---|---|
| committer | Leitwolf11 | 2026-11-06 09:30:09 +0300 |
| commit | 7d1ef624fd8842acab54fce6373b4ad2bbb25eb9 (patch) | |
| tree | 52f3eb670a8fb6246de982b219d10a0346526736 /Documents/ARCHITECTURE.md | |
| parent | e13d8e3d85fed0d8b8421c624dac2e69e3398cab (diff) | |
| download | website-ops/cloudflare-analytics.tar.gz | |
Describe the Web Analytics exception in the architecture and runbookops/cloudflare-analytics
The four hosts of the site now allow Cloudflare's Web Analytics beacon,
but ARCHITECTURE.md and OPERATIONS.md still said the policy blocks every
script an intermediary adds. Both now name the beacon, where it loads
from and where it reports, and keep the forum placeholder's same-origin
policy apart.
Diffstat (limited to 'Documents/ARCHITECTURE.md')
| -rw-r--r-- | Documents/ARCHITECTURE.md | 6 |
1 files changed, 4 insertions, 2 deletions
diff --git a/Documents/ARCHITECTURE.md b/Documents/ARCHITECTURE.md index 53a32ac..40d72eb 100644 --- a/Documents/ARCHITECTURE.md +++ b/Documents/ARCHITECTURE.md @@ -105,5 +105,7 @@ allows only its own script, stylesheet and two images. ## Security headers Nginx sends a content security policy that allows only same-origin resources, plus HSTS, `X-Content-Type-Options`, -`X-Frame-Options: DENY` and a referrer policy. The policy has no exception for third-party scripts; a script injected -by an intermediary, such as an analytics beacon added by a CDN, is blocked by the browser. +`X-Frame-Options: DENY` and a referrer policy. The policy of the four hosts of the site has one exception: Cloudflare +Web Analytics, which Cloudflare adds to every page. Its beacon loads from `https://static.cloudflareinsights.com` and +reports to `https://cloudflareinsights.com` and to `/cdn-cgi/rum` on the same host. Any other script injected by an +intermediary is blocked by the browser. The forum placeholder keeps a policy of its own, same-origin only. |