mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-08 11:46:35 +00:00
build_csp_header moves sources to onion only when the vhost, or without one the app's first domain, is on tor. The new case gives an app only a clearnet domain on a node that runs Tor and renders its header without a vhost: frame-src and connect-src stay clearnet and the header names no onion host. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>