From a690c83e1eaa7d424089b8905445f3b97b970516 Mon Sep 17 00:00:00 2001
From: Florent Tapponnier <160007691+Flotapponnier@users.noreply.github.com>
Date: Fri, 4 Sep 2026 00:15:40 +0200
Subject: [PATCH] =?UTF-8?q?fix(speedtest):=20allow=20https=20connect-src?=
 =?UTF-8?q?=20on=20/speedtest-rpc=20=E2=80=94=20site=20CSP=20blocked=20all?=
 =?UTF-8?q?=20probes?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 next.config.ts | 19 +++++++++++++++++++
 1 file changed, 19 insertions(+)

diff --git a/next.config.ts b/next.config.ts
index 3a23ca7b..f42ba984 100644
--- a/next.config.ts
+++ b/next.config.ts
@@ -112,6 +112,25 @@ const nextConfig: NextConfig = {
         source: "/:path*",
         headers: SECURITY_HEADERS,
       },
+      {
+        // The RPC speed test fires fetch() at user-supplied endpoints
+        // straight from the browser — the whole product. The site-wide
+        // connect-src allowlist blocked every probe (surfaced as a fake
+        // "CORS" failure on endpoints that are actually CORS-open, e.g.
+        // publicnode). Open connect-src to any https origin on THIS
+        // route only; every other directive keeps the tight policy.
+        source: "/speedtest-rpc",
+        headers: [
+          ...SECURITY_HEADERS.filter((h) => h.key !== "Content-Security-Policy"),
+          {
+            key: "Content-Security-Policy",
+            value: CSP.replace(
+              /connect-src [^;]+/,
+              `connect-src 'self' https: ${RELAY_WS}`,
+            ),
+          },
+        ],
+      },
       {
         // Badges are designed to be embedded as <img> in third-party
         // READMEs and blogs. Override frame-ancestors so SVG embedding