# CSP for codex.philiprehberger.com is set by the Next.js middleware at
# web/middleware.ts, which emits a fresh nonce per request so client-
# component hydration scripts can run.
#
# An earlier revision of this file set the policy here with `Header
# always setifempty`, intending to act as a fallback if the middleware
# didn't run. In practice Apache emits its policy alongside the
# upstream's instead of treating the proxied CSP as "already set" —
# browsers intersect multiple CSPs, so the un-nonced fallback ended up
# blocking the nonced inline scripts. Removed the directive so the
# Next.js middleware is the only source of CSP for the dashboard.
#
# If the middleware ever fails to run (catastrophic Next.js outage,
# misconfigured matcher), the response will go out with no CSP — which
# is less harmful than two CSPs whose intersection blocks the app.
#
# Other security headers (X-Frame-Options, Referrer-Policy, etc.) live
# in security-headers-common.conf and continue to be set here.

# Intentionally empty — CSP owned by Next.js middleware.