fix: allow blob: in frame-src CSP for attachment previews #209

2026-04-18 13:04:25 +02:00
parent 966bbe3957
commit b8f39198e1
1 changed files with 1 additions and 1 deletions
@@ -22,7 +22,7 @@ export function proxy(request: NextRequest) {
    `img-src 'self' data: blob: https:`,
    `font-src 'self'`,
    `connect-src ${connectSrc}`,
-    `frame-src 'none'`,
+    `frame-src 'self' blob:`,
    `object-src 'none'`,
    `base-uri 'self'`,
    `form-action 'self'`,