mirror of
https://github.com/screentinker/screentinker.git
synced 2026-06-18 20:22:42 -06:00
827b1c4c87
The web player embeds widget/kiosk renders in a sandboxed (allow-scripts, no allow-same-origin) iframe = a null origin. The global helmet X-Frame-Options: SAMEORIGIN refuses that (null != same-origin), so every widget rendered blank in the web player (video worked since it isn't an iframe). Drop X-Frame-Options on just the /render endpoints - the sandbox, not X-Frame-Options, is what isolates the widget from the dashboard (it still can't read the JWT). Dashboard keeps its clickjacking protection. Verified: directory board now renders in a sandboxed iframe with no refusal. |
||
|---|---|---|
| .. | ||
| config | ||
| db | ||
| lib | ||
| middleware | ||
| player | ||
| routes | ||
| services | ||
| test | ||
| ws | ||
| .gitignore | ||
| config.js | ||
| package-lock.json | ||
| package.json | ||
| server.js | ||