Use Next.js middleware for CSP so frame-ancestors works at runtime

Fixkamo-analytics
已装运
2026年4月17日 19:11 UTC
作者
Kamo
提交
da342fc

The standalone build bakes next.config.ts headers at build time, so ALLOWED_FRAME_URLS was always empty. Move CSP to a Next.js middleware that reads the env var at request time. This allows analytics to be embedded in iframes from kamo-internal without needing build-time env vars.

所有更改

就像你看到的运输?

每一个都自动更新您工作空间的地盘。 开始自由,看它成长 一周又一周.

永远开始自由查看定价