fix(csp): allow https: frames so room widgets load on desktop (#33) #38

Merged

jared merged 1 commits from fix/csp-widgets into main

2026-10-18 19:44:49 -04:00

Author	SHA1	Message	Date
Lotus CIandClaude Opus 5.5	5208d3ca33	fix(csp): allow https: frames so room widgets load on desktop (#33 ) The desktop CSP listed only known embed hosts in frame-src, so every room widget that is not one of them (Jitsi, Etherpad, Grafana, bots) showed a blank frame; the web deploy allows https: frames (#205). Match it. Widget frames are sandboxed by cinny and same-origin widget URLs are refused (isWidgetUrlSafe), so this does not widen what a widget can do to the app. Fixes #33 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017PCb59uY3UKqDqt7B6hzd5	2026-10-18 02:35:39 -04:00

Author

SHA1

Message

Date

Lotus CIandClaude Opus 5.5

5208d3ca33

fix(csp): allow https: frames so room widgets load on desktop (#33 )

The desktop CSP listed only known embed hosts in frame-src, so every
room widget that is not one of them (Jitsi, Etherpad, Grafana, bots)
showed a blank frame; the web deploy allows https: frames (#205).
Match it. Widget frames are sandboxed by cinny and same-origin widget
URLs are refused (isWidgetUrlSafe), so this does not widen what a
widget can do to the app.

Fixes #33

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017PCb59uY3UKqDqt7B6hzd5

2026-10-18 02:35:39 -04:00