From 62d4d99bfb5b12b887c8d2f4d34bd5ea3c6be0ba Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?C=C3=A9dric=20FAMIBELLE-PRONZOLA?= Date: Wed, 8 Jul 2026 07:39:09 +0400 Subject: [PATCH] fix: remove COEP header to allow cross-origin embeds --- includes/security.php | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/includes/security.php b/includes/security.php index 7d25762..dd9e98b 100644 --- a/includes/security.php +++ b/includes/security.php @@ -209,7 +209,8 @@ function setSecurityHeaders() { // Isolation cross-origin header('Cross-Origin-Resource-Policy: same-origin'); header('Cross-Origin-Opener-Policy: same-origin'); - header('Cross-Origin-Embedder-Policy: require-corp'); + // COEP retiré : require-corp bloque les iframes/images/vidéos cross-origin (PeerTube, Mastodon, Castopod, Funkwhale) + // car ces services ne renvoient pas le header CORP approprié. // Permissions Policy (feature policy) header('Permissions-Policy: accelerometer=(), autoplay=(), camera=(), cross-origin-isolated=(), display-capture=(), encrypted-media=(), fullscreen=(self), geolocation=(), gyroscope=(), keyboard-map=(), magnetometer=(), microphone=(), midi=(), payment=(), picture-in-picture=(self), publickey-credentials-get=(), screen-wake-lock=(), sync-xhr=(), usb=(), web-share=(), xr-spatial-tracking=()');