Fixing Cookie Handling and CSP Issues in the Portal — September 2, 2026

Today, I tackled a couple of pressing issues in the portal that were affecting user experience and security. Specifically, I fixed the handling of the gp_theme cookie for anonymous requests and resolved a critical issue with the loading of the daily-js call machine. These fixes were essential for ensuring that the portal remains robust and user-friendly.

The first fix involved the gp_theme cookie. I discovered that this cookie was being honored for anonymous requests, which created a significant problem. Due to the shared nginx page caching configurations, this oversight allowed one user, who had the dark theme set, to inadvertently bake a dark-variant page that was served to everyone else. This was a major cache-poisoning risk that I needed to rectify. After digging through the code and understanding how the caching mechanism worked, I made the decision to stop server-side rendering (SSR) the gp_theme cookie for those anonymous requests. This change should prevent similar issues from arising in the future.

The second fix was related to the daily-js call machine. I realized that the enforced Content Security Policy (CSP) was causing problems when the default loader for daily-js attempted to use eval() to fetch the call-machine bundle. Since the CSP allowed for wasm-unsafe-eval but not unsafe-eval, this led to every Tavus portal call failing at the join stage. I needed to refactor the loading mechanism to avoid using eval altogether. This took a focused hour or so to implement, but the results were worth the effort. By ensuring that the dailyConfig.avoidEval was set, I was able to load the call machine without running into CSP restrictions.

Reflecting on these fixes, I can’t help but appreciate the journey of building this portal solo. Each bug I encounter is both a challenge and an opportunity to strengthen the platform. Even with AI as my assistant, there are moments when I need to dive deep into the code to understand the implications of each change. It’s a grind, but it’s also incredibly rewarding to see the progress I’m making. Each fix brings me one step closer to the vision I have for this one-man-show company with a billion-dollar valuation.

Today’s work was a reminder of the importance of maintaining a secure and user-friendly environment in the agentic web. With the fixes I implemented, I feel more confident that the portal is on the right track. The ability to ensure that users won't encounter unexpected themes or broken functionality is crucial for retention and trust.

As I look ahead, I know there are still many more challenges to tackle, but today felt like a solid step in the right direction. I’m excited to continue building and refining the platform, with every fix and feature moving us closer to a seamless experience for users. The journey is long, but with each small victory, I can see the potential for this project to truly stand out in the world of spatial AI and portal CRM solutions. I’m committed to making this vision a reality, one code commit at a time.