From bd7a3b123d89b5cdead60a7c0d0249bd66bceb78 Mon Sep 17 00:00:00 2001 From: Mikhail Yenuchenko Date: Tue, 11 Aug 2026 00:49:45 +0300 Subject: [PATCH] docs: close the CSP and font-ETag check against the test server Deployed at 1.1.0-post.669f928: the policy is untouched and still admits the fonts, each comes back as font/woff2 with a content ETag that answers a matching If-None-Match with 304, and the signed-out page renders in Plex over the network. The remaining open items all need a signed-in session with real mail behind it. Co-Authored-By: Claude Opus 5 --- docs/plans/visual-style.md | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/docs/plans/visual-style.md b/docs/plans/visual-style.md index 2b64aa4..420a363 100644 --- a/docs/plans/visual-style.md +++ b/docs/plans/visual-style.md @@ -191,10 +191,13 @@ Nothing here blocks the item; each is written down so it is not rediscovered. All three need a running Postfix, so they are a test-server check, not a local one. `table.log` is the only restyled component with no screenshot behind it. -4. **CSP and the font ETags were verified locally from saved files**, where no - policy header is served at all. That the panel's own `default-src 'self'` - admits the WOFF2 files, and that they come back with a validator, is a - test-server check. +4. ~~**CSP and the font ETags**~~ — **done** on the test server at + `1.1.0-post.669f928`. The policy is unchanged + (`default-src 'self'; object-src 'none'; base-uri 'none'; form-action 'self'; + frame-ancestors 'none'`) and admits all three fonts, which come back as + `font/woff2` with `Cache-Control: no-cache` and a content ETag: a matching + `If-None-Match` gets 304, a stale one gets the bytes. The signed-out page + renders in Plex over the network. 5. **`font-display: swap` has never been observed** — every render had the fonts already on disk. Worth one cold load over the network to see how long the system stack is on screen.