Merge pull request 'fix(observability): whitelist Sentry ingest in CSP connect-src' (#70) from fix/sentry-csp-connect-src into dev

2026-06-01 15:28:48 +00:00
parent ed3a777d87 778931c880
commit c01987da7d
1 changed files with 3 additions and 0 deletions
--- a/apps/api/src/main.ts
+++ b/apps/api/src/main.ts
@@ -51,6 +51,9 @@ async function bootstrap() {
            "https://challenges.cloudflare.com",
            "https://destek.sase.tr",
            "wss://destek.sase.tr",
+            // Sentry browser SDK envelope POSTs (otolog org, de region).
+            // Without this CSP silently blocks every error/replay upload.
+            "https://*.ingest.de.sentry.io",
          ],
          objectSrc: ["'none'"],
          frameSrc: ["https://challenges.cloudflare.com", "https://destek.sase.tr"],