From 7d7390ddaf36bb29e5e6f7b7415f7503214eba99 Mon Sep 17 00:00:00 2001
From: yyh <92089059+lyzno1@users.noreply.github.com>
Date: Fri, 4 Sep 2026 08:00:34 +0000
Subject: [PATCH] fix(web): allow CookieYes consent logging (#41812)

---
 web/__tests__/proxy-frame-options.spec.ts | 19 +++++++++++++++++++
 web/proxy.ts                              |  3 ++-
 2 files changed, 21 insertions(+), 1 deletion(-)

diff --git a/web/__tests__/proxy-frame-options.spec.ts b/web/__tests__/proxy-frame-options.spec.ts
index ff65fe8eb68..54385b10f13 100644
--- a/web/__tests__/proxy-frame-options.spec.ts
+++ b/web/__tests__/proxy-frame-options.spec.ts
@@ -88,6 +88,25 @@ describe('proxy frame options', () => {
   })
 })
 
+describe('proxy CookieYes consent logging', () => {
+  it('should allow CookieYes logging requests only through connect-src', () => {
+    vi.stubEnv('NODE_ENV', 'production')
+    const response = proxy(createRequest('https://cloud.dify.ai/signin'))
+    const contentSecurityPolicy = response.headers.get('content-security-policy')!
+    const directives = Object.fromEntries(
+      contentSecurityPolicy
+        .split(';')
+        .map((directive) => directive.trim().split(/\s+/))
+        .filter(([name]) => name)
+        .map(([name, ...sources]) => [name, sources]),
+    )
+
+    expect(directives['connect-src']).toContain('https://log.cookieyes.com')
+    for (const directive of ['default-src', 'script-src', 'style-src', 'worker-src', 'media-src'])
+      expect(directives[directive]).not.toContain('https://log.cookieyes.com')
+  })
+})
+
 describe('proxy education entry normalization', () => {
   it('redirects the legacy education action without leaking it into the canonical URL', () => {
     const response = proxy(
diff --git a/web/proxy.ts b/web/proxy.ts
index da637a724ac..16e9289630a 100644
--- a/web/proxy.ts
+++ b/web/proxy.ts
@@ -7,6 +7,7 @@ import { env } from '@/env'
 
 const NECESSARY_DOMAIN =
   '*.sentry.io http://localhost:* http://127.0.0.1:* https://analytics.google.com googletagmanager.com *.googletagmanager.com https://www.google-analytics.com https://cdn-cookieyes.com https://ungh.cc https://api2.amplitude.com *.amplitude.com'
+const COOKIEYES_LOGGING_ORIGIN = 'https://log.cookieyes.com'
 const CURRENT_PATHNAME_HEADER = 'x-dify-pathname'
 const CURRENT_SEARCH_HEADER = 'x-dify-search'
 const EMBEDDABLE_PATH_SEGMENTS = [
@@ -87,7 +88,7 @@ export function proxy(request: NextRequest) {
 
   const cspHeader = `
     default-src 'self' ${scheme_source} ${csp} ${whiteList};
-    connect-src 'self' ${scheme_source} ${csp} ${whiteList};
+    connect-src 'self' ${scheme_source} ${csp} ${whiteList} ${COOKIEYES_LOGGING_ORIGIN};
     script-src 'self' 'wasm-unsafe-eval' ${scheme_source} ${csp} ${whiteList};
     style-src 'self' 'unsafe-inline' ${scheme_source} ${whiteList};
     worker-src 'self' ${scheme_source} ${csp} ${whiteList};