Index: src/server.js
===================================================================
--- src/server.js	(revision 90259da618fae54c487ea9a4998162d68c8cb3a0)
+++ src/server.js	(revision 16b0c005569dfa6bbec9512f9815fd7100ebe95a)
@@ -93,5 +93,6 @@
         "https://s.ytimg.com",       // YouTube player-assets
         "https://w.soundcloud.com",  // SoundCloud Widget API (api.js)
-        "https://open.spotify.com",  // Spotify iFrame API
+        "https://open.spotify.com",  // Spotify iFrame API (loader)
+        "https://*.spotifycdn.com",  // Spotify iFrame API (echte bundle: embed-cdn.spotifycdn.com)
       ],
       // Helmet's default zet script-src-attr op 'none', wat ALLE inline event-
@@ -103,5 +104,5 @@
       styleSrc: ["'self'", "'unsafe-inline'"],
       imgSrc: ["'self'", "data:", "https:"],
-      connectSrc: ["'self'", "wss:", "ws:"],
+      connectSrc: ["'self'", "wss:", "ws:", "https://*.spotifycdn.com", "https://*.scdn.co"],
       // blob: is required for the audio player — it fetch()es track bytes and
       // plays from a blob: object URL (Spotify-style). Without blob: here the