CSP: Add Content-Security-Policy header restricting resources to own domain #18

Context

The site is deployed on GitHub Pages with a custom domain (antibody.fort-collins.colorado.anecdote.channel). GitHub Pages does not support custom HTTP response headers, so there is currently no Content-Security-Policy header in place.

With the introduction of piece citation submodules — where a pre-built guest.html is embedded verbatim into the built page — it becomes important that a CSP is enforced to prevent the guest content from loading external scripts, styles, or other resources.

Goal

Ensure that every page served from this civic node sends a Content-Security-Policy header (or equivalent) that restricts resource loading to the site's own origin ('self').

Options to evaluate

1. Cloudflare Worker / Transform Rule — if the domain is proxied through Cloudflare, a Transform Rule or Worker can inject the header on every response with no changes to the build output
2. <meta http-equiv="Content-Security-Policy"> — can be added to the base layout in journal.anecdote.channel; covers script-src, style-src, and similar directives but not frame-ancestors or upgrade-insecure-requests
3. Custom deployment step — post-process _site/ to inject headers if using a platform that supports a _headers file (Netlify, Cloudflare Pages)

Related

• Piece citation guest.html embedding: #(see CSP sandbox issue)
• See also: journal.anecdote.channel PR for raw_include Liquid tag