From 51090f85ff8a4dd345c6617b2a876c3ab14d6189 Mon Sep 17 00:00:00 2001 From: Claude Date: Tue, 15 Sep 2026 22:35:18 +0000 Subject: Allow yb.tl in CSP frame-src so the GGR tracker embed can actually load The Golden Globe Race map added in 55f7605 was silently blocked by doot's own Content-Security-Policy: frame-src only allowed YouTube and Windy, so the browser refused the yb.tl iframe outright, independent of whether yb.tl itself permits framing (it does). yb.tl/ggr2026 redirects to cf.yb.tl/ggr2026, so both hosts are allow-listed. Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_018AwnALZL6bD4VBtATDVv3B --- internal/middleware/security.go | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/internal/middleware/security.go b/internal/middleware/security.go index 834b385..d8a9edd 100644 --- a/internal/middleware/security.go +++ b/internal/middleware/security.go @@ -28,7 +28,7 @@ func SecurityHeaders(debug bool) func(http.Handler) http.Handler { "script-src 'self' 'unsafe-inline' https://unpkg.com; "+ "style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://cdn.jsdelivr.net; "+ "font-src 'self' https://fonts.gstatic.com; "+ - "frame-src https://www.youtube.com https://embed.windy.com; "+ + "frame-src https://www.youtube.com https://embed.windy.com https://yb.tl https://cf.yb.tl; "+ "connect-src 'self' wss: ws:") next.ServeHTTP(w, r) -- cgit v1.2.3