Read ALLOWED_FRAME_URLS at runtime so CSP frame-ancestors works in standalone mode

Spegnimento

17 aprile 2026 alle ore 19:04 UTC

Autore

Kamo

Impegno

dd02991

The env var was being read at module scope during build, baking an empty value into the standalone server. Move CSP and all header construction into functions called by the async headers() callback so they resolve at request time with the runtime environment.