From 8fe8beb6866e6ba7ffc4de728934d7c63256757c Mon Sep 17 00:00:00 2001
From: Hariom Balhara <hariombalhara@gmail.com>
Date: Fri, 15 Mar 2024 21:12:10 +0530
Subject: [PATCH] fix: Avoid CSP related warnings in console on booking pages.
 (#14072)

---
 .env.example        | 1 +
 apps/web/lib/csp.ts | 9 ++++++++-
 2 files changed, 9 insertions(+), 1 deletion(-)

diff --git a/.env.example b/.env.example
index 17f4d19cc4..9d3259b328 100644
--- a/.env.example
+++ b/.env.example
@@ -232,6 +232,7 @@ NEXT_PUBLIC_COMPANY_NAME="Cal.com, Inc."
 # NEXT_PUBLIC_DISABLE_SIGNUP=true
 NEXT_PUBLIC_DISABLE_SIGNUP=
 
+# Set this to 'non-strict' to enable CSP for support pages. 'strict' isn't supported yet. Also, check the README for details.
 # Content Security Policy
 CSP_POLICY=
 
diff --git a/apps/web/lib/csp.ts b/apps/web/lib/csp.ts
index c28a9429dd..03fbabe962 100644
--- a/apps/web/lib/csp.ts
+++ b/apps/web/lib/csp.ts
@@ -84,7 +84,14 @@ export function csp(req: IncomingMessage | NextRequest | null, res: OutgoingMess
     const enforced =
       "cache" in req ? req.headers.get("x-csp-enforce") === "true" : req.headers["x-csp-enforce"] === "true";
 
-    const name = enforced ? "Content-Security-Policy" : "Content-Security-Policy-Report-Only";
+    // No need to enable REPORT ONLY mode for CSP unless we start actively working on it. See https://github.com/calcom/cal.com/issues/13844
+    const name = enforced ? "Content-Security-Policy" : /*"Content-Security-Policy-Report-Only"*/ null;
+
+    if (!name) {
+      return {
+        nonce: undefined,
+      };
+    }
 
     const value = getCspPolicy(nonce)
       .replace(/\s{2,}/g, " ")