fix: CSP — frame-src autorise la console du service d'agents (mode console du panneau Spark) BUG-119

2026-10-24 03:10:34 +00:00
parent b0ac6dfdb9
commit 287afa1537
12 changed files with 60 additions and 14 deletions
@@ -194,7 +194,7 @@ class SecurityHeadersMiddleware(BaseHTTPMiddleware):
                "connect-src 'self' blob: https://esm.sh https://unpkg.com https://cdnjs.cloudflare.com https://fonts.googleapis.com https://fonts.gstatic.com https://cdn.jsdelivr.net https://agent.dracodev.net; "
                "font-src 'self' data: https://fonts.gstatic.com https://esm.sh; "
                "worker-src 'self' blob:; "
-                "frame-src 'self' blob:; "
+                "frame-src 'self' blob: https://agent.dracodev.net; "
                "object-src 'none'; "
                "base-uri 'self'; "
                "form-action 'self'; "