I am trying to enable Lunr.js offline search in my hugo site with docsy theme.

I have enabled the following in my config.toml file

# Enable Lunr.js offline search
offlineSearch = true
offlineSearchSummaryLength = 70
offlineSearchMaxResults = 10

and disabled the following algolia_docsearch , gcs_engine_id

when I run locally on my mac, the search functionality works.

however, when I deployed it on S3 backed by CloudFront, it gives me the following error

Refused to load the script 'https://unpkg.com/[email protected]/lunr.min.js' because it violates the following Content Security Policy directive: "script-src 'self' https://code.jquery.com https://stackpath.bootstrapcdn.com https://cdnjs.cloudflare.com". Note that 'script-src-elem' was not explicitly set, so 'script-src' is used as a fallback.

Upon some trial and test, I have realized that this CDN 'https://unpkg.com/[email protected]/lunr.min.js causes an issue.

When I add the following CDN, it works!.

<script src="https://cdnjs.cloudflare.com/ajax/libs/lunr.js/2.3.9/lunr.min.js" integrity="sha512-4xUl/d6D6THrAnXAwGajXkoWaeMNwEKK4iNfq5DotEbLPAfk6FSxSP3ydNxqDgCw1c/0Z1Jg6L8h2j+++9BZmg==" crossorigin="anonymous" referrerpolicy="no-referrer"></script>

My hugo project use the following this submodules https://github.com/google/docsy/tree/2bedb2ff278eddba4a7fc4441ca6bf7a42caeb68

This submodules by default put "https://unpkg.com/[email protected]/lunr.min.js" and does not allow me to change it to "https://cdnjs.cloudflare.com/ajax/libs/lunr.js/2.3.9/lunr.min.js"

My question is how could I resolve this Content Security Policy issue to enable “offline-search”