diff options
| author | Claude <noreply@anthropic.com> | 2026-09-15 22:35:18 +0000 |
|---|---|---|
| committer | Claude <noreply@anthropic.com> | 2026-09-15 22:35:18 +0000 |
| commit | 51090f85ff8a4dd345c6617b2a876c3ab14d6189 (patch) | |
| tree | 2e01e83e1239d69a74c0167a9e6c0132daaba4d9 | |
| parent | 55f7605862f6e7fc5b0ddd80d6abff510cdf79eb (diff) | |
Allow yb.tl in CSP frame-src so the GGR tracker embed can actually load
The Golden Globe Race map added in 55f7605 was silently blocked by
doot's own Content-Security-Policy: frame-src only allowed YouTube and
Windy, so the browser refused the yb.tl iframe outright, independent of
whether yb.tl itself permits framing (it does). yb.tl/ggr2026 redirects
to cf.yb.tl/ggr2026, so both hosts are allow-listed.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018AwnALZL6bD4VBtATDVv3B
| -rw-r--r-- | internal/middleware/security.go | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/internal/middleware/security.go b/internal/middleware/security.go index 834b385..d8a9edd 100644 --- a/internal/middleware/security.go +++ b/internal/middleware/security.go @@ -28,7 +28,7 @@ func SecurityHeaders(debug bool) func(http.Handler) http.Handler { "script-src 'self' 'unsafe-inline' https://unpkg.com; "+ "style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://cdn.jsdelivr.net; "+ "font-src 'self' https://fonts.gstatic.com; "+ - "frame-src https://www.youtube.com https://embed.windy.com; "+ + "frame-src https://www.youtube.com https://embed.windy.com https://yb.tl https://cf.yb.tl; "+ "connect-src 'self' wss: ws:") next.ServeHTTP(w, r) |