Web CSP blocks the TikTok oEmbed lookup, so TikTok short links never play on chat.lotusguild.org #18

New Issue

2026-10-04T17:41:27-04:00

jared commented

2026-10-04 17:41:27 -04:00

What happens
For TikTok links without a numeric video id (tiktok.com/t/…, vm.tiktok.com/…), cinny resolves the id with fetch('https://www.tiktok.com/oembed?url=…') (cinny src/app/components/url-preview/UrlPreviewCard.tsx:1491, src/app/utils/videoEmbed.ts:115). The production CSP's connect-src (cinny/nginx-security-headers.conf:15) doesn't include https://www.tiktok.com, so the request is refused and the card shows as failed.

Verified on chat.lotusguild.org (login page, Playwright):

Connecting to 'https://www.tiktok.com/oembed?url=…' violates the following Content Security Policy directive: "connect-src 'self' https://matrix.lotusguild.org …"

frame-src https: already allows the TikTok player itself. The desktop app is unaffected: its connect-src allows https:.

Fix
Add https://www.tiktok.com to connect-src in cinny/nginx-security-headers.conf (then nginx -t && nginx -s reload on LXC 106).

More context

Who: web users only (desktop's connect-src allows https:); any TikTok link without a numeric id: tiktok.com/t/…, vm.tiktok.com/…, and share links from the TikTok app (which are almost always short links).

Manual repro: send https://vm.tiktok.com/ZM…/ in a room on chat.lotusguild.org and press Play on the card → "Couldn't load" (the console shows the CSP violation).

Fix: one line in cinny/nginx-security-headers.conf (connect-src … https://www.tiktok.com), deployed to LXC 106 with nginx -t && nginx -s reload. While there, consider documenting which external connect-src hosts features need (today: isitup, giphy, tiktok) next to the header.

Found in the October 2026 client audit (Playwright against a local Synapse + LiveKit stack, plus code reading). Code refs are at cinny 30e2dbcd, cinny-desktop 8f67ec7, element-call 3b0050e8.

**What happens** For TikTok links without a numeric video id (`tiktok.com/t/…`, `vm.tiktok.com/…`), cinny resolves the id with `fetch('https://www.tiktok.com/oembed?url=…')` (cinny `src/app/components/url-preview/UrlPreviewCard.tsx:1491`, `src/app/utils/videoEmbed.ts:115`). The production CSP's `connect-src` (`cinny/nginx-security-headers.conf:15`) doesn't include `https://www.tiktok.com`, so the request is refused and the card shows as failed. **Verified** on chat.lotusguild.org (login page, Playwright): ``` Connecting to 'https://www.tiktok.com/oembed?url=…' violates the following Content Security Policy directive: "connect-src 'self' https://matrix.lotusguild.org …" ``` `frame-src https:` already allows the TikTok player itself. The desktop app is unaffected: its `connect-src` allows `https:`. **Fix** Add `https://www.tiktok.com` to `connect-src` in `cinny/nginx-security-headers.conf` (then `nginx -t && nginx -s reload` on LXC 106). ### More context **Who:** web users only (desktop's `connect-src` allows `https:`); any TikTok link without a numeric id: `tiktok.com/t/…`, `vm.tiktok.com/…`, and share links from the TikTok app (which are almost always short links). **Manual repro:** send `https://vm.tiktok.com/ZM…/` in a room on chat.lotusguild.org and press Play on the card → "Couldn't load" (the console shows the CSP violation). **Fix:** one line in `cinny/nginx-security-headers.conf` (`connect-src … https://www.tiktok.com`), deployed to LXC 106 with `nginx -t && nginx -s reload`. While there, consider documenting which external `connect-src` hosts features need (today: isitup, giphy, tiktok) next to the header. --- _Found in the October 2026 client audit (Playwright against a local Synapse + LiveKit stack, plus code reading). Code refs are at cinny `30e2dbcd`, cinny-desktop `8f67ec7`, element-call `3b0050e8`._

jared added the infra priority: low bug labels 2026-10-04 17:41:27 -04:00

jared referenced this issue

2026-10-04 20:33:35 -04:00

Web CSP blocks mozilla.org's homeserver discovery, so the mozilla.org login option on chat.lotusguild.org always says "Failed to connect" #21

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: LotusGuild/matrix#18