Changeset fb02cc0 in Klonkt

Timestamp:

06/16/2026 08:43:15 PM (3 months ago)

Author:

roboburr <roboburr@…>

Branches:

main

Children:

221a209

Parents:

62b899d

Message:

Circle: /media CORP=cross-origin so circle images load cross-origin

Helmet set CORP=same-origin on all responses, including /media → the
browser blocked circle covers/avatars from other Klonkt sites (file arrived,
but was not displayed). Public media is now explicitly cross-origin
embeddable.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@…>

File:

• src/server.js (modified) (1 diff)

src/server.js

@@ -156 +156 @@
 
 app.use('/assets', express.static(path.join(__dirname, 'assets'), { maxAge: isDev ? 0 : '1y' }));
-app.use('/media', express.static(process.env.MEDIA_PATH || './storage/media'));
+app.use('/media', express.static(process.env.MEDIA_PATH || './storage/media', {
+  // Publieke media (post-covers, avatars) moet door andere Klonkt-sites in hun
+  // CIRKEL cross-origin embedbaar zijn. Helmet zet standaard CORP=same-origin,
+  // wat die afbeeldingen in de browser blokkeert (bestand komt wél binnen, maar
+  // de browser weigert 'm te tonen). Voor /media dus expliciet cross-origin.
+  setHeaders: (res) => res.setHeader('Cross-Origin-Resource-Policy', 'cross-origin'),
+}));
 
 // (Verwijderd) TWA / digital-asset-links — alleen nodig voor de APK/TWA-variant.