Currently, I'm attempting to activate Lunr.js offline search on my Hugo site using the Docsy theme.
In my config.toml file, I have made the following adjustments:
# Enable Lunr.js offline search
offlineSearch = true
offlineSearchSummaryLength = 70
offlineSearchMaxResults = 10
I have also disabled the algolia_docsearch
and gcs_engine_id
entries.
Locally, on my Mac, the search feature functions correctly.
However, upon deployment to S3 backed by CloudFront, I encounter the following error:
Refused to load the script 'https://unpkg.com/<a href="/cdn-cgi/l/email-protection" class="__cf_email__" data-cfemail="48243d263a087a667b">[email protected]</a>/lunr.min.js' due to a Content Security Policy violation. This is because the directive "script-src 'self' https://code.jquery.com https://stackpath.bootstrapcdn.com https://cdnjs.cloudflare.com" is being violated. It's worth noting that 'script-src-elem' was not explicitly set, so 'script-src' is used as a fallback.
After some experimentation, I discovered that the CDN
'https://unpkg.com/<a href="/cdn-cgi/l/email-protection" class="__cf_email__" data-cfemail="7519001b0735475b465b4d">[email protected]</a>/lunr.min.js'
is causing the issue.
Upon adding the following CDN, the issue is resolved:
<script src="https://cdnjs.cloudflare.com/ajax/libs/lunr.js/2.3.9/lunr.min.js" integrity="sha512-4xUl/d6D6THrAnXAwGajXkoWaeMNwEKK4iNfq5DotEbLPAfk6FSxSP3ydNxqDgCw1c/0Z1Jg6L8h2j+++9BZmg==" crossorigin="anonymous" referrerpolicy="no-referrer"></script>
The submodules used in my Hugo project can be found at https://github.com/google/docsy/tree/2bedb2ff278eddba4a7fc4441ca6bf7a42caeb68
By default, these submodules include
"https://unpkg.com/<a href="/cdn-cgi/l/email-protection" class="__cf_email__" data-cfemail="83eff6edf1c3b1adb0adbb">[email protected]</a>/lunr.min.js"
and do not provide the option to switch it to "https://cdnjs.cloudflare.com/ajax/libs/lunr.js/2.3.9/lunr.min.js"
My main concern is resolving this Content Security Policy issue to enable "offline-search" without being hindered by the submodule overwrites preventing the addition of a content security meta
tag. For reference, here is the link to the submodules: https://github.com/google/docsy/tree/2bedb2ff278eddba4a7fc4441ca6bf7a42caeb68