Changeset 353c39c in Klonkt

Timestamp:

05/20/2026 10:19:03 PM (4 months ago)

Author:

Robin Genis <roboburr@…>

Branches:

main

Children:

c88783e

Parents:

21522ae

Message:

audio: allow blob: in CSP media-src (fix Step-1 no-play/auto-skip loop)

Step 1 (blob playback) shipped without blob: in the CSP media-src directive
("self" https:). The browser silently blocked <audio>.src = blob:... so the
player fired error on every track and auto-skipped through the whole queue
without playing anything. self/https: do NOT imply blob:.

Co-Authored-By: Claude Opus 4.7 <noreply@…>

File:

• src/server.js (modified) (1 diff)

src/server.js

@@ -64 +64 @@
       imgSrc: ["'self'", "data:", "https:"],
       connectSrc: ["'self'", "wss:", "ws:"],
-      mediaSrc: ["'self'", "https:"],
+      // blob: is required for the audio player — it fetch()es track bytes and
+      // plays from a blob: object URL (Spotify-style). Without blob: here the
+      // CSP silently blocks <audio>.src = blob:… → the player fires 'error' and
+      // auto-skips every track. 'self'/https: do NOT imply blob:.
+      mediaSrc: ["'self'", "https:", "blob:"],
       fontSrc: ["'self'"],
       frameSrc: [