invalid header rules due to exceeds the maximum allowed length of 2000 on CloudFlare
#606
Labels
bug
Something isn't working
Comments
|
Hey there, Thanks for reporting this issue. I think it is a duplicate of #504. Could you share your case there so that we can keep track of it there? :) |
|
Hi @Baroshem, I saw that issue, but it's a different problem. #504 is about the maximum allowed count of header rules, which is mainly dependent on the amount of pages one has. This issue is about the maximum line length of a single header (specifically I assume, that such a long header might also be problematic under other (non-CloudFlare) circumstances or environments. |
|
Ah I see, thanks for clarification. It seems that as you mentioned it is caused the the SHA's but based on my knowledge this is how it is supposed to work (generate SHA for each script). Please correct me if I am wrong here @vejja - can we somehow provide a fix for that? |
|
I see |
|
@Baroshem, @vejja
Here is the head (I've removed all <head>
<meta charset="utf-8" />
<meta
http-equiv="Content-Security-Policy"
content="base-uri 'none'; font-src 'self' https: data:; form-action 'self'; img-src 'self' data:; object-src 'none'; script-src-attr 'none'; style-src 'self' https: 'unsafe-inline'; script-src 'self' https: 'unsafe-inline' 'strict-dynamic' 'sha256-ivIk8jaIlJqI/VSuZ8WHKfP9c9l7LuFY9r+imeCj5ZU=' 'sha256-s7Gxndj2Fs1Svxn4Ebnl9mbhGNWS24dfQiqkJqtLORg=' 'sha256-txDvJsTLV/6i1zmOdtyVSzv2RLT6MkALP2DDZqmtCD4=' 'sha256-QvQBjbj2aQY2P9qTWwSytonvotg/78METR6U18ggmkM=' 'sha256-g6IsjQHgKALf5QtDySRTgavUSFYe0FfgDyOdLkzsLwc=' 'sha256-fDvWSMyiCDTo5V7EOLKIsWRCl0jJ+oo6ZjjheIsIRls=' 'sha384-4wfGye9ie622jNW15gO5XJswu86+pVupqh1XnmnepYG2aQOCInQmWmfdyLeALaGe' 'sha384-E8i6wIfdEhoGSk4bMkt1GrgOmzMuiLf7EB4ldCa8ASpWBcAPBiEEr7jMnUaWsuZH' 'sha384-9FxzviiYaqUCfhqxF8B9ohvdX6Z8l+5611aYFT55IU+/1nucWqaIReLX/DZYFKUb' 'sha384-fRUoyithyogf7jb+MfZet6pUKd19S0jSC52ohqKtbty12KYrVBKGECaQ+gonUJ+5' 'sha384-wV/FyIfkoKuneA9gx32UbcC1rWydYJhlr+cMCHu0oN57ZtVcBz8nUCI/A5rPOyHo' 'sha384-ToawDtXs5JMLQozIv2MRp2tOUzWKnoontSmC/9KaQeRpYwGLR7HQVgQFAs8Jb4mV' 'sha384-eOtbXiZTy8xAmrVNPt/NyoFI1LZqPegwRSyOCkmJezrmOerB+aI22hkOeZTPuSR+' 'sha384-i8pwAPYYgqzaXtUXJ+oVFazfupcSSLkyTdcwqjLwj8E+7r6h1jR9aTEI4xg+yYuM' 'sha384-LalqKzJxrb/AsvIqdwTNMpu53c/4SRVwvsjkkm8//wB1mIei0cti8MphRkOZsYv/' 'sha384-ZATK5wueae9xHCqn6GVSqFRE8a/PPmte2l3YKpANy84TEOn7WDdVK/2H8aZlZChc' 'sha384-4O0uR16qWHMD/lgD6laTNSkIpgPGciTv9JHMSPiJTiG0qatbqvz065G9QHNW12ws' 'sha384-CdL3nOcUm+6vAWfFp7Q//ZGn3i7GCMMEIqSwI8FgtdhQh7GlTWGmW5h/xkJIDDcq' 'sha384-4iP93nV+NLFIO3Qjggb5BnhsRmbRDvELHHObG2vBitsUolm/QqPac8tcvvuwvW+g' 'sha384-/9DTJk8688GJ6seSZEExlFkZz92DztIEMkTWbOPwS+9u1ZdIPvcMQHfLZsnjWUkp' 'sha384-Lw3xtYYlNU4+zEPJdB4HK7Sq2QrIGVlemgERPueGH7mC2T4jjfiLLpjfqf13XyLQ' 'sha384-9z2pWQrhs2hZn3Jlea91hV6g6pJbAyYjeI2Z9Ll5G3gUV8OjlPZwbwBfARHoZVTh' 'sha384-/aE5nQaiFTRdC9EHkbMoqqYsRIuy0242XUO5SdPqj6kl//j7wp9RV4uG+8cudjkI' 'sha384-v4B7QXnb60+7Sc8ne7vrUY0qPc7uefiWe3bNrmCbNygn5RGBc8zH2Km7Pt0Q4VJH' 'sha384-nSXIYbotrKOyw7dKNmfvUIQoXjFvuvTL/4Jv7FvRiwH+rLHTYYRX13/nAjnd2Xev' 'sha384-Byq1/DPIOaGtsB+qXp7fNq/smaOUtaquZNn/by3F80iTD3lGH8Us0xrjb4JzbK5x' 'sha384-E4RV4R94AN+VZDZTetW4v1iCt/o8Q0f+9tciIxOQuSxEYvLHdcAT4i8Xz79Xguyp' 'sha384-+GtwRNWOXDa+bSIl3qHFtxmh1wDq9BRQr0b13HBTCjBmiVOMRmSfoEgFbjmgQZre' 'sha384-b5kNi2Wlg0ovx0wVdnlYFET4TT5e5Htz3FHuWf689AFbXpq2V4yOEdoW+CnXRwxp' 'sha384-ILIrvqtvo1x+HgZQrFnAyXRUkxmS/Fkx7WFuLHPHIp6OzE3CTM4hqHv6J68dt/lc' 'sha384-PcrU8+tNkthCJODWZy/D9673qhfQtGDA0f4XA9/xpJm3j+7uyX5p6FYMOS+BO4pe' 'sha384-jkDN3FHWmUHWHisR41EPvjfc1GKDS34FLG3Tlbsofu7cJYIWnozlNcSfWbRx38l9' 'sha384-KKt10WmsQtMibpBAADKV16neETLstN3jEy78NJ1phd4ThNf2erUrjA4x0AcISGZv' 'sha384-IsSoHmhQsLTZPfsFZwDEt+8sjz4OQBLfuArFfskE8kMUxixWNn/M9VM20GweuegN' 'sha384-jMM8GbrPhO+Pi6/80v78tow7j0J8TZxt9Ls2G5jsIQe3ALG8V4epeeN0oLodQCJs' 'sha384-MSebpXxnI/yY3W4zideRHIWbRG7tmljpVX/+6L5jOEfdfw7kHTWVef0mWqMakLuY' 'sha384-9HbXC8OXnQ+5xQvr59JvCAVaKnRBVyvRJSnmqGGqZtyoTzJ50ORpYGD6nu7nriPw' 'sha384-px31bpw7yAqqi6jGA2nO89IHVQvaj7RoM6K8T0Wy5S125iUahMHpS0ZZHZ923SNp' 'sha384-PJVWdjp3lzCL6BO9e2nTrEK9leixxkfK9bo190T/dRZHvmvuvhW89r3C9lbd4OFq' 'sha384-nOEOZrj+MWblBbzsduUE8jzvOUtc3MtRsiZtuwObrEp/fuOhgsJBfAJpPsv/LLK3' 'sha384-27h6IUllCXJziGET9fTSGZIyMTBGHrRUr6H27kHsQjPUwsnL5bNZhshnlPFSd3DQ' 'sha384-GAx/iuUPR9tQZeq3dd9OyRJDOzQ2a+GxsQGRVvJIP8uqxU7qx2PiZB2aWdT37fgW' 'sha384-P0v0X0QGjOCfoI+MVisD04qzwW0xpOp/rWzUUG/lNIX2Xa0z5rtabqCmspkp2oeT' 'sha384-kuYJeRj+dsasQ5/QiNHEoLtf04VXRamZSIv24gjj3ef+LcJNtLTvTB8DeZY9QgoD' 'sha384-hO0leGx734Q/hZX1DAUamXdh9M4ZA31bqgrVEKctjci2lR9EZ3qlBSht4VNGNJvj' 'sha384-F0ins2r3iu79Yu0QetQvDgMsP0GxxsQmqL8ufObGkD/BgkuJm5jUOoVy+wcm37en' 'sha384-CcZry2mYpVh+MES4dVxU0vFqnmX8i27KX7BAnQHr0mmeAlFuPvxb848Hm+IF8Hwm' 'sha384-9qr+4mSgebAr4QuOaVr4/gGLos5oAuhgQuJIe26fIYGsInwDO/OI9E35QW6tCJqR' 'sha384-0p4wtgPn0yvWpXelXDrqJrv6YSblHKSjH+PLCNYWmnBr2VtBqkw2PWk8LQ7QBqCe' 'sha384-DeMQTbAo/oIdy3zjFYsM0y/yrcFjgHL2IbRjv2E0OM8/y3FCQxDu8kfByWdvohuE' 'sha384-LExiycu6nWWrzEe5k9x3MJ+5lP1N4DY1xm22UYvp5wwe1dHmcv6KRUpN8meMdEHX' 'sha384-ezdF3xYX0wqStS0czRbFIpZDW/GO0NRkAY4vJ8eGPnj2Bqo8v8ItqJ2EJ0otz6YH' 'sha384-w+Ls1MsdN1At01PWQPcqdlRa0cidf8BKYnbm0P4embuUsDU1TaPmUn51AS6+WFWJ' 'sha384-9VagSRhMX7lYLGc8uPLRxEp+bYOhqNdM/hLEb6c1XShnOct1wL+HnK0Od08oJM77' 'sha384-im2eUYDaCZj2BDk7PwV/bqZI9gaAY6jjuj09wcJu4DOslJIAw5ymPjR4FbGxVLMc' 'sha384-qKsg5apG3MtuiWzl3YIk6MwZ2Hc+xyoQVldfEVKxJtMBPmY7qgvAyV8acdzQ2cM8' 'sha384-KfIHTvfRu4YqaiC9YMgOs6qaTHQz5xK4SgFVKlKIrwCj7hd4b5O+viaDekLdyhMR' 'sha384-hwn7dmNY0OjvChuWFnoLQiwmYUAQG/HcdKM/BvNWdM/swDhTEsj3awrPU05MGqb8' 'sha384-tkNtzNa1L1PG+k8QQw2nmiZnb3UKnEekUWx/tluZetEg9/2GXzR6JznC1T9XApKp' 'sha384-zqj2CyrWkHcNoaGr9z2bC924ULs5Tyq+xd0+IwZkhrsAOb3eKU3VFRDX0iG62Wx6' 'sha384-RtHhG9SmFW1SjDAS5DPsH9hDbRBZqa9ChJ7NqLNlmhw8Abe2UblKZbB+5jGPmDTG' 'sha384-Y+rV66sdKDeHPxG8OvIev4Xx9EuRJtZ0P0pIZTil0F5rN5K4NyYiPuFzxhaYs3dH' 'sha384-ouh7Om/Q5zcUnQYt3r6llk595ivHNd6SLBcz1uogo5JVuPNs5w7NBqbiykGsVzlh' 'sha384-+UeJEe0IV5Nspp4IeCIKxwlzw7OS82naNcsgtTZcanl3epOClvxsJURduWSewUoF' 'sha384-fhPhR2AjGhHGTtSK01bGrHrq/OxN4z0sRAx5+1ThP71MsNmJZ+DJT+OMP++nLNC4' 'sha384-J/eWaql+gMHVxP+BhqRICbr23pGCBgffKy0aIbUhgH7QrHT92jmHIqoXvKJn8ogU' 'sha384-TQv+iak/+zVj3bNMsuk6ml0Vlq4H8H7CjxXGyh+4sHpcZv2m2AliKQXpS7r9pq0V' 'sha384-YdbkcLQXkN3f7EXkc3GNqKyA5KnupxUa3f+Z/Jz4feBQ9q1zRuS3QtP0Lk2+GH2a' 'sha384-3nREccX5kofNhkL45NzofJFWNTnbWqZkwXt3+/56fnSdH5mU3UfcjuyP92yZJc8K' 'sha384-MvIB40081t78tAmeEgXeovkzpiw1sw7aYHGXEshaIPUakruMbepSE0+xhIoSrWgd' 'sha384-FEs3yfhdBo6v8Qz0cz4ZmY41DAI2kfCN5s9jSoN6Nq5ZlPEbKm0MEFt/39mcfXCt' 'sha384-OmH0m6yVy2O+LkDsjv34Bmqe+/IdvWg+lQQugedxLrB6hQd+wNF6TMDdjcohEVbi'; upgrade-insecure-requests;"
/>
<meta name="viewport" content="width=device-width, initial-scale=1" />
<title>Home - My Website</title>
<link
rel="preload"
as="image"
imagesrcset="/assets/images/639x426/smart/filters:format(webp):quality(80)/f/289247/1920x1280/46ffc05d85/architektur_204.jpg 639w, /assets/images/767x511/smart/filters:format(webp):quality(80)/f/289247/1920x1280/46ffc05d85/architektur_204.jpg 767w, /assets/images/1023x682/smart/filters:format(webp):quality(80)/f/289247/1920x1280/46ffc05d85/architektur_204.jpg 1023w, /assets/images/1278x852/smart/filters:format(webp):quality(80)/f/289247/1920x1280/46ffc05d85/architektur_204.jpg 1278w, /assets/images/1279x853/smart/filters:format(webp):quality(80)/f/289247/1920x1280/46ffc05d85/architektur_204.jpg 1279w, /assets/images/1534x1022/smart/filters:format(webp):quality(80)/f/289247/1920x1280/46ffc05d85/architektur_204.jpg 1534w, /assets/images/1535x1023/smart/filters:format(webp):quality(80)/f/289247/1920x1280/46ffc05d85/architektur_204.jpg 1535w, /assets/images/1920x1280/smart/filters:format(webp):quality(80)/f/289247/1920x1280/46ffc05d85/architektur_204.jpg 1920w, /assets/images/2046x1364/smart/filters:format(webp):quality(80)/f/289247/1920x1280/46ffc05d85/architektur_204.jpg 2046w, /assets/images/2558x1706/smart/filters:format(webp):quality(80)/f/289247/1920x1280/46ffc05d85/architektur_204.jpg 2558w, /assets/images/3070x2046/smart/filters:format(webp):quality(80)/f/289247/1920x1280/46ffc05d85/architektur_204.jpg 3070w, /assets/images/3840x2560/smart/filters:format(webp):quality(80)/f/289247/1920x1280/46ffc05d85/architektur_204.jpg 3840w"
imagesizes="(max-width: 640px) 639px, (max-width: 768px) 767px, (max-width: 1024px) 1023px, (max-width: 1280px) 1279px, (max-width: 1536px) 1535px, (max-width: 2048px) 1920px, 1920px"
/>
<meta name="msapplication-TileColor" content="#aa191e" />
<meta name="theme-color" content="#ffffff" />
<link rel="icon" type="image/svg+xml" href="/favicon.svg" />
<link rel="icon" type="image/png" href="/favicon-96x96.png" sizes="96x96" />
<link
rel="shortcut icon"
type="image/png"
href="/favicon.ico"
sizes="96x96"
/>
<link rel="apple-touch-icon" sizes="180x180" href="/apple-touch-icon.png" />
<link rel="manifest" href="/site.webmanifest" />
<meta name="description" content="This is my website." />
<meta name="robots" content="index,follow" />
<meta property="og:url" content="https://my-url.example.com" />
<meta property="og:type" content="website" />
<meta property="og:site_name" content="My Website" />
<meta property="og:locale" content="de" />
<meta property="og:title" content="Home - My Website" />
<meta property="og:description" content="This is my website." />
<meta name="apple-mobile-web-app-title" content="My Website" />
<meta name="application-name" content="My Website" />
<meta name="twitter:card" content="summary_large_image" />
<meta property="twitter:site" content="@my-website" />
<meta property="twitter:creator" content="@me" />
<meta property="twitter:url" content="https://my-url.example.com" />
<meta name="twitter:title" content="Home - My Website" />
<meta name="twitter:description" content="This is my website." />
<meta
property="og:image"
content="/assets/images/1200x630/smart/filters:quality(80)/f/289247/1920x1280/46ffc05d85/architektur_204.jpg"
/>
<meta
name="twitter:image"
content="/assets/images/1200x630/smart/filters:quality(80)/f/289247/1920x1280/46ffc05d85/architektur_204.jpg"
/>
<link rel="canonical" href="https://my-url.example.com" />
<link rel="alternate" hreflang="de" href="https://my-url.example.com/" />
<link rel="alternate" hreflang="en" href="https://my-url.example.com/en" />
<script type="application/ld+json" data-hid="6553f88">
{
"@context": "https://schema.org",
"@type": "WebSite",
"@id": "https://my-url.example.com/#website",
"url": "https://my-url.example.com",
"name": "My Website"
}
</script>
<script type="application/ld+json" data-hid="5bc3eb6">
{
"@context": "https://schema.org",
"@type": "WebPage",
"url": "https://my-url.example.com",
"inLanguage": "de-DE",
"name": "Home - My Website",
"description": "This is my website.",
"breadcrumb": {
"@type": "BreadcrumbList",
"itemListElement": [
{
"@type": "ListItem",
"position": 1,
"item": {
"@type": "WebPage",
"@id": "https://my-url.example.com",
"url": "https://my-url.example.com",
"name": "Home"
}
}
]
}
}
</script>
<script type="application/ld+json" data-hid="758233f">
{
"@context": "https://schema.org",
"@type": "ImageObject",
"@id": "https://my-url.example.com/#primaryimage",
"url": "/assets/images/1200x630/smart/filters:quality(80)/f/289247/1920x1280/46ffc05d85/architektur_204.jpg"
}
</script>
<script type="application/ld+json" data-hid="7fe4105">
{
"@context": "https://schema.org",
"@type": "Organization",
"name": "Adwerba",
"legalName": "Adwerba",
"address": {
"@type": "PostalAddress",
"addressCountry": "AT",
"addressLocality": "Salzburg",
"postalCode": "5020",
"streetAddress": "Schallmooser Hauptstraße 85A "
},
"geo": {
"@type": "GeoCoordinates",
"latitude": "47.80827789588115",
"longitude": "13.06094056931345"
},
"image": null,
"logo": null,
"email": "[email protected]",
"url": "https://my-url.example.com",
"telephone": "+43 662 64 31 25",
"faxNumber": null
}
</script>
<script
integrity="sha384-4wfGye9ie622jNW15gO5XJswu86+pVupqh1XnmnepYG2aQOCInQmWmfdyLeALaGe"
type="module"
src="/_nuxt/MSjzoOib.js"
crossorigin
></script>
</head>Let me know, if you need any more info! |
|
Hmm, putting this in nuxt-config: security: {
ssg: {
exportToPresets: false
}
},... results in these error messages:
|
|
One of your modules (or - less likely - yourself) is inserting inline event handlers. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Environment
Nuxt Security Version
v2.1.5
Default setup used?
Yes, the bug happens even if the security option is not customized
Security options
Reproduction
Description
Many thanks for creating this package!
When building my app for hosting on CloudFlare, SSG prerendered pages result in the following warning:
Looking at the generated
dist/_headersfile, thecontent-security-policyheader and specifically all the sha256-hashes seem to be the problem.Here is an example:
Is there any way to mitigate this? Should i simply use
contentSecurityPolicy: false?Additional context
No response
Logs
The text was updated successfully, but these errors were encountered: