fix: Avoid CSP related warnings in console on booking pages. (#14072)

.env.example

@@ -232,6 +232,7 @@ NEXT_PUBLIC_COMPANY_NAME="Cal.com, Inc."
 # NEXT_PUBLIC_DISABLE_SIGNUP=true
 NEXT_PUBLIC_DISABLE_SIGNUP=
 
+# Set this to 'non-strict' to enable CSP for support pages. 'strict' isn't supported yet. Also, check the README for details.
 # Content Security Policy
 CSP_POLICY=
 

apps/web/lib/csp.ts

@@ -84,7 +84,14 @@ export function csp(req: IncomingMessage | NextRequest | null, res: OutgoingMess
     const enforced =
       "cache" in req ? req.headers.get("x-csp-enforce") === "true" : req.headers["x-csp-enforce"] === "true";
 
-    const name = enforced ? "Content-Security-Policy" : "Content-Security-Policy-Report-Only";
+    // No need to enable REPORT ONLY mode for CSP unless we start actively working on it. See https://github.com/calcom/cal.com/issues/13844
+    const name = enforced ? "Content-Security-Policy" : /*"Content-Security-Policy-Report-Only"*/ null;
+
+    if (!name) {
+      return {
+        nonce: undefined,
+      };
+    }
 
     const value = getCspPolicy(nonce)
       .replace(/\s{2,}/g, " ")