Changeset 07de464 in Klonkt for src/server.js

Timestamp:

06/27/2026 09:37:05 AM (2 months ago)

Author:

Robin Genis <roboburr@…>

Branches:

main

Children:

f3551ec

Parents:

5421ce1

Message:

fix(csp): global frame-src (https:) for embeds, locked to 'self' on authorize_interaction

• server.js — Helmet frameSrc → 'self' https: so embeds work in every context (feed, htmx/PWA, public pages); Robin chose global over per-domain.
• middleware/render.js — renderPage now LOCKS frame-src down to 'self' on pages/authorize-interaction (untrusted remote content next to the interact buttons → no embeds/clickjacking); removed the now-unused per-domain embedOriginsFor helper.

File:

• src/server.js (modified) (1 diff)

src/server.js

@@ -125 +125 @@
       mediaSrc: ["'self'", "https:", "blob:"],
       fontSrc: ["'self'"],
-      frameSrc: [
-        "'self'",
-        "https://open.spotify.com",
-        "https://w.soundcloud.com",
-        "https://bandcamp.com",
-        "https://embed.music.apple.com",
-        "https://www.youtube-nocookie.com",
-        "https://www.youtube.com",   // YouTube IFrame API sometimes creates a www.youtube.com iframe
-        "https://player.vimeo.com",
-      ],
+      // Embeds (platform players + cross-site Klonkt audio players) are framed broadly:
+      // ANY https origin, so embeds work in any context (feed, htmx/PWA nav, public pages).
+      // The sensitive /authorize_interaction page tightens frame-src back to 'self' in
+      // renderPage — it shows untrusted remote content next to the interact buttons.
+      frameSrc: ["'self'", "https:"],
     },
   },