Timestamp:
06/27/2026 09:30:42 AM (3 months ago)
Author:
Robin Genis <roboburr@…>
Branches:
main
Children:
07de464
Parents:
ca0ad44
Message:

fix(csp): per-domain frame-src for cross-site embeds on the document (not authorize_interaction)

  • middleware/render.js — renderPage now appends the site's timeline origins (followed + boosted, from ap_timeline, 60s cache) to the document CSP frame-src for a logged-in site manager, so cross-site Klonkt embeds also load after an htmx/PWA navigation (the per-/news injection is ignored once you navigate via htmx). Excluded on pages/authorize-interaction — untrusted remote content next to the interact buttons, so no embeds / no frame-src loosening there (clickjacking).
(No files)

Note: See TracChangeset for help on using the changeset viewer.