From 37bd490072a6703782f6ae19a124abb4be9749e2 Mon Sep 17 00:00:00 2001
From: Denis Teyssier <admin@mascali.ovh>
Date: Mon, 20 Apr 2026 09:03:05 +0200
Subject: [PATCH] fix: added media-src CSP rule for media attachments #209

---
 proxy.ts | 1 +
 1 file changed, 1 insertion(+)

diff --git a/proxy.ts b/proxy.ts
index 348328a2..f7e087d6 100644
--- a/proxy.ts
+++ b/proxy.ts
@@ -28,6 +28,7 @@ export function proxy(request: NextRequest) {
     `base-uri 'self'`,
     `form-action 'self'`,
     `frame-ancestors ${frameAncestors}`,
+    `media-src 'self' blob:`,
   ].join("; ");
 
   // Skip intl middleware for /admin routes - they have their own layout