fix: Add Algolia domains to CSP config for DocSearch (#1082)
The Content-Security-Policy header was blocking Algolia DocSearch scripts
and API requests, causing the search functionality to not work on the
documentation site.
This fix adds the required Algolia domains to both script-src and
connect-src directives in the CSP header.
Issue: Search functionality not working on pulsar.apache.org
diff --git a/static/.htaccess b/static/.htaccess
index c8b4fac..25f2732 100755
--- a/static/.htaccess
+++ b/static/.htaccess
@@ -32,5 +32,5 @@
RewriteRule "^pulsar-manager-release-notes/?$" "/release-notes" [R=301,DPI,L]
<IfModule mod_headers.c>
- Header set Content-Security-Policy "script-src 'self' widget.kapa.ai www.google.com https://hcaptcha.com https://*.hcaptcha.com https://www.gstatic.com 'unsafe-inline' 'unsafe-eval'; connect-src 'self' proxy.kapa.ai kapa-widget-proxy-la7dkmplpq-uc.a.run.app metrics.kapa.ai https://hcaptcha.com https://*.hcaptcha.com www.google.com; frame-src 'self' www.google.com https://hcaptcha.com https://*.hcaptcha.com; style-src 'self' 'unsafe-inline' https://hcaptcha.com https://*.hcaptcha.com;"
+ Header set Content-Security-Policy "script-src 'self' https://*.algolia.net https://*.algolianet.com https://*.algolia.io widget.kapa.ai www.google.com https://hcaptcha.com https://*.hcaptcha.com https://www.gstatic.com 'unsafe-inline' 'unsafe-eval'; connect-src 'self' https://*.algolia.net https://*.algolianet.com https://*.algolia.io proxy.kapa.ai kapa-widget-proxy-la7dkmplpq-uc.a.run.app metrics.kapa.ai https://hcaptcha.com https://*.hcaptcha.com www.google.com; frame-src 'self' www.google.com https://hcaptcha.com https://*.hcaptcha.com; style-src 'self' 'unsafe-inline' https://hcaptcha.com https://*.hcaptcha.com;"
</IfModule>
\ No newline at end of file