Remove redundant + stale netlify.toml [[headers]] /* block (fix Header-rules advisory)#102
Draft
maryadawson-code wants to merge 1 commit into
Draft
Remove redundant + stale netlify.toml [[headers]] /* block (fix Header-rules advisory)#102maryadawson-code wants to merge 1 commit into
maryadawson-code wants to merge 1 commit into
Conversation
…block The site defines security headers in three places; Sprint B (2026-05-13) documented a two-owner model but left a duplicate [[headers]] for="/*" block in netlify.toml carrying a STALE CSP (old jsdelivr + *.stripe.com wildcard) that the security-headers edge function already overrides. Proven redundant before removal: - X-Frame-Options / X-Content-Type-Options / Referrer-Policy: identical values already in _headers (/* ). - Content-Security-Policy / Permissions-Policy / Strict-Transport-Security: owned by the security-headers edge function (path "/*", every route, always wins) — the toml CSP was dead weight. - Cache blocks LEFT IN PLACE (their values diverge from _headers; not safe to consolidate without live-header verification). Removes the divergence risk the edge-function comment flags and should clear Netlify's 'invalid header rules' advisory. No functional header change. Cleared via the deploy preview's own Header-rules check. Build clean; validate-dist OK (500 pages); validate-routes ✓. https://claude.ai/code/session_01UfEkVEJVGnwenskuXuyc6E
✅ Deploy Preview for curious-pony-0dec76 ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What this is
Fixes the long-standing Netlify "Header rules — N invalid" advisory (red on PRs #99 and #100) by removing a redundant, stale
[[headers]] for="/*"block fromnetlify.toml.Why it's safe (proven redundant before removal)
The site documents a two-owner model for security headers (Sprint B, 2026-05-13) but left a third definition in
netlify.tomlthat duplicated everything and had drifted:_headers(/*, identical values)security-headersedge function (path "/*", every route, always wins)The netlify.toml CSP was the pre-Sprint-B version (still listed the removed
jsdelivrorigin and the old*.stripe.comwildcard that was narrowed to explicit Stripe subdomains). The edge function already overrode it on every route, so it was dead weight — and exactly the divergence risk the edge-function's own comment warns about.Removing it changes no effective response header: every header it set is still emitted by
_headersor the edge function.What I deliberately left alone
The cache
[[headers]]blocks. Their values diverge from_headers(images 1yr-immutable vs 30-day; JS 300/600 vs 3600), and I can't tell which is authoritative without verifying live response headers — so consolidating them blind would risk changing cache behavior. Out of scope for this safe pass.Verification
node build.jsclean;validate-distOK (500 pages);validate-routes✓.https://claude.ai/code/session_01UfEkVEJVGnwenskuXuyc6E
Generated by Claude Code