https://an9.dev/writing Notes on building data-driven passion projects. en-US https://an9.dev/writing/spotify-now-playing-strict-csp https://an9.dev/writing/spotify-now-playing-strict-csp Sat, 20 Jun 2026 00:00:00 GMT How the little 'currently listening' card on this site stays live without ever leaking a Spotify token — and why a nonce-based Content-Security-Policy made it interesting. Next.js Spotify API Security CSP