fix(ui): csp prevents iframe content from showing

defenseunicorns · Aug 30, 2024 · ff71c56 · ff71c56
1 parent ba63878
commit ff71c56
Showing 1 changed file with 2 additions and 1 deletion.
diff --git a/src/leapfrogai_ui/src/hooks.server.ts b/src/leapfrogai_ui/src/hooks.server.ts
@@ -103,7 +103,8 @@ const csp: Handle = async ({ event, resolve }) => {
       process.env.PUBLIC_SUPABASE_URL,
       process.env.SUPABASE_AUTH_EXTERNAL_KEYCLOAK_URL
     ],
-    'child-src': ["'none'"], // note - this will break the annotations story and will need to updated to allow the correct resource
+    'child-src': ["'none'"],
+    'frame-src': [`blob: 'self'`],
     'frame-ancestors': ["'none'"]
   };