Changeset 07de464 in Klonkt for src/routes/posts.js

Timestamp:

06/27/2026 09:37:05 AM (2 months ago)

Author:

Robin Genis <roboburr@…>

Branches:

main

Children:

f3551ec

Parents:

5421ce1

Message:

fix(csp): global frame-src (https:) for embeds, locked to 'self' on authorize_interaction

• server.js — Helmet frameSrc → 'self' https: so embeds work in every context (feed, htmx/PWA, public pages); Robin chose global over per-domain.
• middleware/render.js — renderPage now LOCKS frame-src down to 'self' on pages/authorize-interaction (untrusted remote content next to the interact buttons → no embeds/clickjacking); removed the now-unused per-domain embedOriginsFor helper.

(No files)