From 105a05322558120ccbdaf433c34d61a0d7ddcdfa Mon Sep 17 00:00:00 2001 From: Yurii M Date: Mon, 20 Jul 2026 21:45:55 +0300 Subject: [PATCH] Allow blob: in frame-src so in-page PDF previews can render MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The PDF Number Extractor's viewer modal frames a URL.createObjectURL() blob of the user's own file; frame-src 'self' blocked it. blob: frames only ever contain content the page itself created — no external origin can be framed through this. Co-Authored-By: Claude Fable 5 --- vercel.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/vercel.json b/vercel.json index 51376a4..306f98b 100644 --- a/vercel.json +++ b/vercel.json @@ -26,7 +26,7 @@ }, { "key": "Content-Security-Policy", - "value": "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' 'wasm-unsafe-eval' https://challenges.cloudflare.com https://va.vercel-scripts.com; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob: https:; font-src 'self' data:; connect-src 'self' https://*.supabase.co wss://*.supabase.co https://api.stripe.com https://challenges.cloudflare.com https://*.vercel-insights.com https://vitals.vercel-insights.com; frame-src 'self' https://challenges.cloudflare.com; worker-src 'self' blob:; object-src 'none'; base-uri 'self'; frame-ancestors 'self'" + "value": "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' 'wasm-unsafe-eval' https://challenges.cloudflare.com https://va.vercel-scripts.com; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob: https:; font-src 'self' data:; connect-src 'self' https://*.supabase.co wss://*.supabase.co https://api.stripe.com https://challenges.cloudflare.com https://*.vercel-insights.com https://vitals.vercel-insights.com; frame-src 'self' blob: https://challenges.cloudflare.com; worker-src 'self' blob:; object-src 'none'; base-uri 'self'; frame-ancestors 'self'" } ] },