Fixing SSR Cookie Issues & CSP Compliance in the Portal — September 2, 2026

Today, I set out to resolve two pressing issues that were affecting the functionality of my agentic web portal. The first was a problem with the SSR cookie for anonymous requests, specifically the gp_theme cookie. The second was a compliance issue with my Content Security Policy (CSP) that was causing failures in the daily-js call machine. After a focused hour of work, I successfully shipped two fixes that not only improved the portal's performance but also enhanced its security.

The first fix addressed the SSR handling of the gp_theme cookie. Previously, the shared nginx page caches were not correctly managing the cookie for anonymous users. This oversight allowed one visitor with a dark theme to inadvertently bake a dark-variant page that was then served to everyone else. I realized that the caching mechanism didn’t vary based on the gp_theme cookie, which created a significant user experience issue. After some debugging, I implemented a cache-poison guard that ensures the cookie is never SSR’d for anonymous requests. This fix should prevent any future instances of theme leakage across users, ensuring that everyone sees the intended design.

The second issue I tackled involved the daily-js call machine. The enforced CSP was blocking the default loader’s use of eval(), which was required for fetching the call-machine bundle. This was particularly problematic because it caused every Tavus portal call to fail at the join stage. To resolve this, I modified the dailyConfig to avoid eval altogether. This change not only aligns with CSP requirements but also enhances the overall security of my portal by eliminating the need for unsafe-eval. It was a bit tricky to navigate the nuances of the CSP, but I feel a sense of accomplishment having overcome it.

Working solo on this project means that I have to wear many hats, and today was no exception. I had to dive deep into both the theme management and the CSP settings, which are not always straightforward. Each fix required careful consideration of how they interact with the overall architecture of the portal. I spent around an hour on these tasks, which felt like a good use of my time. It’s moments like these that reinforce my belief in the importance of rigorous testing and security practices, especially as I build toward a one-man-show company.

Reflecting on these fixes, I’m reminded of how crucial it is to maintain a high standard of quality in the code I write. A single oversight can lead to significant issues down the line, and being mindful of these details is essential. I also appreciate the support from AI tools like Claude Code in VS Code, which help me navigate the complexities of development without the need for a larger team. This independence is empowering, especially as I work toward my ambitious goal of achieving a billion-dollar valuation.

As I move forward, I’ll continue to focus on enhancing both the functionality and security of my portal. There’s still much to be done, and I’m excited about the potential for future improvements. Each fix brings me one step closer to the vision I have for the agentic web, and I’m committed to building a platform that is not only powerful but also user-friendly and secure. Today’s work was a reminder that even small fixes can have a big impact, and I’m looking forward to what lies ahead on this journey.