[tehw0lf]

Summary

• Add 'unsafe-hashes' and both Angular Material SHA256 hashes to script-src to allow this.media='all' inline event handler
• Fixes missing styles on all Angular Material apps

Summary by CodeRabbit

• Bug Fixes
  • Updated cross-origin response headers to improve how content is loaded across sites.
  • Adjusted resource sharing behavior for better compatibility with embedded and external assets.
  • Kept all other security-related headers unchanged.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 3b31801e-39e5-4e0a-abc0-2fb2b45277ea

📥 Commits

Reviewing files that changed from the base of the PR and between 235338c and e2818fc.

📒 Files selected for processing (1)

• security-headers.conf

---

📝 Walkthrough

Walkthrough

security-headers.conf updates two Cross-Origin response headers and leaves the rest of the header set unchanged in the provided diff.

Changes

Security header configuration

Layer / File(s)	Summary
Cross-Origin header values security-headers.conf	Changes Cross-Origin-Embedder-Policy to credentialless and Cross-Origin-Resource-Policy to cross-origin; the Referrer-Policy line remains present.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~2 minutes

Poem

A bunny hopped by the header lane,
Credentialless now danced in the rain.
Cross-origin ears gave a cheerful twitch,
And referrer policy stayed in the niche.
🐇✨

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Title check	⚠️ Warning	The title mentions script-src hashes, but the shown diff only changes COEP/CORP security headers.	Rename the PR to describe the actual cross-origin header changes, or include the CSP script-src hash update if that is intended.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/csp-script-hashes

---

_{Comment @coderabbitai help to get the list of available commands.}