Targets whose home page redirects are checked at /robots.txt (closes #194)

The browser follows a redirect, so the figures for the AWS Console, Akamai, B2 and the S3 regions also timed the page it led to. Each of these targets is now checked at /robots.txt on its own host, which answers without a redirect. So is the Google Cloud Console, whose home page redirects curl's requests. The S3 regions are checked with a HEAD request, as Chrome closes their connection after most GET requests. README.md says what a figure includes. Model: opus-5-5
2026-10-26 02:52:06 +00:00
parent a72797a403
commit 8be53283d3
5 changed files with 153 additions and 41 deletions
@@ -8,10 +8,9 @@ add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" alway
 # Scripts and styles load only from the page's own origin. Inline ones
 # are blocked, style attributes in markup included, so style elements
 # through classes or element.style. data: images are for the favicon
-# in web/index.html. connect-src is * because the browser checks each
-# probe in web/src/main.js against it, and also every redirect the probe
-# follows, and several of those hosts redirect to others; a list of
-# hosts here would block those probes. It also covers the reports the
+# in web/index.html. connect-src is * because the page checks every
+# target in web/src/main.js. A list of hosts here would have to change
+# with every change to those targets. It also covers the reports the
 # page sends to its own origin.
 add_header Content-Security-Policy "default-src 'self'; connect-src *; img-src 'self' data:; object-src 'none'; base-uri 'none'; form-action 'none'; frame-ancestors 'none'" always;