mirror of https://github.com/hanzoai/insights-js.git synced 2026-10-30 18:34:19 +00:00

Files

T

zeekay e43ab1afe7 chore: rename all PostHog references to Insights/Hanzo

Bulk rename across 989 files:
- Package names: posthog-js → @hanzo/insights, posthog-node → @hanzo/insights-node, etc.
- Repository URLs: posthog/posthog-js → hanzoai/insights-js
- Brand names: PostHog → Insights
- File renames: 259 reference JSON files, source files, workflow files
- Directory rename: eslint-plugin-posthog-js → eslint-plugin-insights

Remaining: 8 refs to @posthog/rrweb-* (real npm deps, need fork+publish)

2026-03-06 01:41:12 -08:00

3.0 KiB

Raw Permalink Blame History

CSP Violations Playground

A development playground for testing CSP violation reports with Insights.

Setup

Before running the playground, make sure to update the required env variables for server.js to work:

Create a .env file in the root directory with the following variables:

INSIGHTS_PROJECT_API_KEY=your_insights_token
INSIGHTS_API_HOST=your_insights_api_host  # e.g., https://app.insights.hanzo.ai
INSIGHTS_UI_HOST=your_insights_ui_host    # e.g., https://app.insights.hanzo.ai
INSIGHTS_USE_SNIPPET=true                # if you want to include the insights snippet on the playground pages to track pageviews, etc.

These environment variables are required for the playground to work correctly. The server will fail to start if they are not properly configured.

Installation

Install the dependencies:

pnpm i

Running the Playground

pnpm dev

This uses nodemon to automatically restart the server when you make changes to the files.

Usage

Once the server is running, open your browser and navigate to:

http://localhost:8080

The playground includes examples for different types of CSP violations:

Basic CSP Violations

Inline Script Violation - Tests violations of inline scripts
External Script Violation - Tests loading scripts from non-allowed domains
External Image Violation - Tests loading images from non-allowed domains
External Style Violation - Tests loading stylesheets from non-allowed domains
XHR Violation - Tests making XHR requests to non-allowed domains
Eval Violation - Tests scripts with eval present

Report-To Debug Cases

These test cases are specifically designed to debug report-to directive issues and test the logging functionality added in PR #32868:

Debug Enabled - Tests CSP reports with debug=true parameter for verbose logging
Invalid Content Type - Tests CSP reports sent with incorrect content type to trigger error logging
Report-URI Only - Tests pages using only report-uri directive (no report-to)
Report-To Only - Tests pages using only report-to directive (no report-uri)
Both Report Directives - Tests pages using both report-uri and report-to directives
Malformed Reporting Endpoints - Tests malformed Reporting-Endpoints header to trigger error logging
Sampling Test - Generates multiple violations rapidly with random query parameters and hashes to bypass URL-based sampling and test sampling behavior and logging

Each example will automatically trigger a CSP violation when the page loads, which will be reported to your configured CSP endpoint.

How it Works

The server sets a Content Security Policy header that restricts what resources can be loaded. When a resource violates this policy, the browser will send a report to the specified report-uri endpoint.

This playground is useful for testing how CSP violation reports are processed by your Insights instance.

3.0 KiB Raw Permalink Blame History