Files
cinny-desktop/src-tauri
Lotus CIandClaude Opus 5.5 5208d3ca33 fix(csp): allow https: frames so room widgets load on desktop (#33)
The desktop CSP listed only known embed hosts in frame-src, so every
room widget that is not one of them (Jitsi, Etherpad, Grafana, bots)
showed a blank frame; the web deploy allows https: frames (#205).
Match it. Widget frames are sandboxed by cinny and same-origin widget
URLs are refused (isWidgetUrlSafe), so this does not widen what a
widget can do to the app.

Fixes #33

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017PCb59uY3UKqDqt7B6hzd5
2026-10-18 02:35:39 -04:00
..
2022-04-29 19:52:14 +05:30
2026-03-03 23:16:04 +11:00