Changeset 5421ce1 in Klonkt for src/views/pages

Timestamp:

06/27/2026 09:30:42 AM (2 months ago)

Author:

Robin Genis <roboburr@…>

Branches:

main

Children:

07de464

Parents:

ca0ad44

Message:

fix(csp): per-domain frame-src for cross-site embeds on the document (not authorize_interaction)

• middleware/render.js — renderPage now appends the site's timeline origins (followed + boosted, from ap_timeline, 60s cache) to the document CSP frame-src for a logged-in site manager, so cross-site Klonkt embeds also load after an htmx/PWA navigation (the per-/news injection is ignored once you navigate via htmx). Excluded on pages/authorize-interaction — untrusted remote content next to the interact buttons, so no embeds / no frame-src loosening there (clickjacking).

(No files)