From b8f39198e1be34f4540e74b3dc6f784a98ab8256 Mon Sep 17 00:00:00 2001
From: Linus Rath <139418639+rathlinus@users.noreply.github.com>
Date: Sat, 18 Apr 2026 13:04:25 +0200
Subject: [PATCH] fix: allow blob: in frame-src CSP for attachment previews
 #209

---
 proxy.ts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/proxy.ts b/proxy.ts
index 7414d317..6fcd2dfe 100644
--- a/proxy.ts
+++ b/proxy.ts
@@ -22,7 +22,7 @@ export function proxy(request: NextRequest) {
     `img-src 'self' data: blob: https:`,
     `font-src 'self'`,
     `connect-src ${connectSrc}`,
-    `frame-src 'none'`,
+    `frame-src 'self' blob:`,
     `object-src 'none'`,
     `base-uri 'self'`,
     `form-action 'self'`,