diff --git a/next.config.js b/next.config.js index 82306a04d..3eb8271ec 100644 --- a/next.config.js +++ b/next.config.js @@ -24,6 +24,8 @@ const baseSecurityHeaders = [ }, ] +const articlesAllowedDomains = "https://*.spotify.com/ https://spotify.com https://*.youtube.com/ https://youtube.com https://*.twitter.com/ https://twitter.com" + /** @type {import('next').NextConfig} */ module.exports = withBundleAnalyzer({ @@ -40,7 +42,7 @@ module.exports = withBundleAnalyzer({ headers: [ { key: "Content-Security-Policy", - value: `frame-ancestors 'self'; frame-src ${process.env.NEXT_PUBLIC_IPFS_GATEWAY_SAFE};` + value: `frame-ancestors 'self'; frame-src ${process.env.NEXT_PUBLIC_IPFS_GATEWAY_SAFE} ${articlesAllowedDomains} 'self';` }, ...baseSecurityHeaders, ] @@ -54,15 +56,6 @@ module.exports = withBundleAnalyzer({ } ] }, - { - source: "/sandbox", - headers: [ - { - key: "Content-Security-Policy", - value: `frame-ancestors 'self';` - }, - ] - }, { source: "/sandbox/preview.html", headers: [ diff --git a/src/components/NFTArticle/elements/Embed/EmbedSpotify.tsx b/src/components/NFTArticle/elements/Embed/EmbedSpotify.tsx index 74004af8d..541fa14a7 100644 --- a/src/components/NFTArticle/elements/Embed/EmbedSpotify.tsx +++ b/src/components/NFTArticle/elements/Embed/EmbedSpotify.tsx @@ -13,6 +13,7 @@ const EmbedSpotify = memo(({ href }) => { className={style.spotify} src={src} width="660px" height="380" frameBorder="0" + sandbox="allow-same-origin allow-scripts" allow="autoplay; clipboard-write; encrypted-media; fullscreen; picture-in-picture"> diff --git a/src/components/NFTArticle/elements/Embed/EmbedYoutube.tsx b/src/components/NFTArticle/elements/Embed/EmbedYoutube.tsx index 0336e5cdd..05644c77f 100644 --- a/src/components/NFTArticle/elements/Embed/EmbedYoutube.tsx +++ b/src/components/NFTArticle/elements/Embed/EmbedYoutube.tsx @@ -18,6 +18,7 @@ const EmbedYoutube = memo(({ href }) => { src={embedUrl} title="YouTube video player" frameBorder="0" + sandbox="allow-same-origin allow-scripts" allow="accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture; fullscreen" >