Strip CSP headers on POS pages

[kilbot]

Summary

• Security plugins (LiteSpeed Cache, Wordfence, etc.) set Content-Security-Policy headers that block the POS from loading JS/CSS bundles from cdn.jsdelivr.net
• Strips both Content-Security-Policy and Content-Security-Policy-Report-Only headers before rendering any POS template
• Follows the existing pattern used for X-Frame-Options removal in Init.php
• Adds woocommerce_pos_content_security_policy filter for users who want to set a custom policy
• No CSP is set by default to avoid breaking payment gateway scripts that load from unpredictable domains

Test plan

• Install LiteSpeed Cache (or similar security plugin that sets CSP headers) and enable CSP headers with a restrictive policy (e.g. script-src 'self'; style-src 'self' 'unsafe-inline')
• Open the POS frontend — verify JS/CSS bundles from jsdelivr load without CSP violations in the browser console
• Open the POS payment page (process an order with a gateway like Stripe) — verify payment gateway scripts still load correctly
• Open the POS auth page — verify login works without interference
• Check browser dev tools Network tab → Response Headers — verify no Content-Security-Policy header is present on POS pages
• Verify non-POS pages (regular WordPress frontend, admin) still have CSP headers from the security plugin

🤖 Generated with Claude Code

Summary by CodeRabbit

• Bug Fixes
  • Improved security header management for point-of-sale operations to prevent conflicts with JavaScript and CSS resource loading in the POS interface.

[github-actions]

PHPUnit Test Results

696 tests  +696   688 ✅ +688   57s ⏱️ +57s
 39 suites + 39     8 💤 +  8 
  1 files   +  1     0 ❌ ±  0 

Results for commit 5ab6881. ± Comparison against base commit f862f4b.

♻️ This comment has been updated with latest results.

[coderabbitai]

📝 Walkthrough

Walkthrough

A new private method is introduced to the POS Template Router that cleans Content-Security-Policy headers before loading POS templates. The method removes existing CSP headers and applies a filter allowing custom CSP policies to be set during POS endpoint template redirection.

Changes

Cohort / File(s)	Summary
CSP Header Management includes/Template_Router.php	Added private method clean_response_headers() that removes Content-Security-Policy headers and applies a woocommerce_pos_content_security_policy filter to allow optional custom CSP policy configuration during POS template loading.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~20 minutes

Poem

🐰 A rabbit hops through headers with care,
Brushing away CSP from the air,
With filters applied so policies shine,
The POS template loads—perfectly fine!
Security and function, now both in line. 🛡️✨

🚥 Pre-merge checks | ✅ 3

✅ Passed checks (3 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title 'Strip CSP headers on POS pages' directly and specifically describes the main change: removing Content-Security-Policy headers on POS pages to resolve JS/CSS loading issues.
Docstring Coverage	✅ Passed	Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing touches

• 📝 Generate docstrings

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Post copyable unit tests in a comment
• Commit unit tests in branch fix/csp-headers

---

No actionable comments were generated in the recent review. 🎉

Warning

Review ran into problems

🔥 Problems

Git: Failed to clone repository. Please run the @coderabbitai full review command to re-trigger a full review. If the issue persists, set path_filters to include or exclude specific files.

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}