use 1x1 GIF for placeholder image

nginx/nginx.conf

@@ -311,6 +311,14 @@ http {
             add_header Cache-Control "public, max-age=604800";
         }
 
+        location ~ "\.gif$" {
+            include snippets/security-headers.conf;
+            add_header Cross-Origin-Resource-Policy "same-origin" always;
+            add_header Cache-Control "public, max-age=31536000, immutable";
+            gzip_static off;
+            brotli_static off;
+        }
+
         location ~ "\.png$" {
             include snippets/security-headers.conf;
             # avoid breaking image hotlinking such as https://github.com/TryGhost/Ghost/issues/12880

static/index.html

@@ -90,7 +90,7 @@ <h1 id="device-integrity-monitoring">
                 <p>Subscribe a device to regularly submitting attestations to this account by pressing 'Enable remote verification' in the Auditor app menu and scanning the QR code for this account:</p>
                 <section id="pairing">
                     <h2><a href="#pairing">Pair devices</a></h2>
-                    <img id="qr" height="300" width="300" alt="" src="/placeholder.png"/>
+                    <img id="qr" height="300" width="300" alt="" src="/placeholder.gif"/>
                     <button id="rotate">Rotate device subscription key</button>
                 </section>
                 <form id="configuration">

static/monitoring.js

@@ -62,7 +62,7 @@ function toSecurityLevelString(value) {
 }
 
 function reloadQrCode() {
-    qr.src = "/placeholder.png";
+    qr.src = "/placeholder.gif";
     qr.alt = "";
     post("/api/account.png", localStorage.getItem("requestToken")).then(response => {
         if (!response.ok) {
@@ -456,7 +456,7 @@ for (const logoutButton of document.getElementsByClassName("logout")) {
             accountContent.hidden = true;
             username.innerText = null;
             configuration.reset();
-            qr.src = "/placeholder.png";
+            qr.src = "/placeholder.gif";
             qr.alt = "";
             loggedInButtons.hidden = true;
             logout.disabled = false;