cedric/annu-kute-ced
1
0
Fork 0
forked from ORGANISATION-KA-INTERNATIONALE/FEDIVERSE-OKI
Code Pull Requests Activity

fix: remove COEP header to allow cross-origin embeds

Browse Source
This commit is contained in:
Cédric Famibelle-Pronzola
2026-07-08 07:39:09 +04:00
parent 3e249bbc34
commit 62d4d99bfb
1 changed files with 2 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
includes/security.php
+2 -1
View File
@@ -209,7 +209,8 @@ function setSecurityHeaders() {
// Isolation cross-origin // Isolation cross-origin
header('Cross-Origin-Resource-Policy: same-origin'); header('Cross-Origin-Resource-Policy: same-origin');
header('Cross-Origin-Opener-Policy: same-origin'); header('Cross-Origin-Opener-Policy: same-origin');
header('Cross-Origin-Embedder-Policy: require-corp'); // COEP retiré : require-corp bloque les iframes/images/vidéos cross-origin (PeerTube, Mastodon, Castopod, Funkwhale)
// car ces services ne renvoient pas le header CORP approprié.
// Permissions Policy (feature policy) // Permissions Policy (feature policy)
header('Permissions-Policy: accelerometer=(), autoplay=(), camera=(), cross-origin-isolated=(), display-capture=(), encrypted-media=(), fullscreen=(self), geolocation=(), gyroscope=(), keyboard-map=(), magnetometer=(), microphone=(), midi=(), payment=(), picture-in-picture=(self), publickey-credentials-get=(), screen-wake-lock=(), sync-xhr=(), usb=(), web-share=(), xr-spatial-tracking=()'); header('Permissions-Policy: accelerometer=(), autoplay=(), camera=(), cross-origin-isolated=(), display-capture=(), encrypted-media=(), fullscreen=(self), geolocation=(), gyroscope=(), keyboard-map=(), magnetometer=(), microphone=(), midi=(), payment=(), picture-in-picture=(self), publickey-credentials-get=(), screen-wake-lock=(), sync-xhr=(), usb=(), web-share=(), xr-spatial-tracking=()');