Add an opt-in allowlist of iframe embed providers, on by default for new installs - #480

Merged

jeremy merged 8 commits into

mainfrom

iframe-provider-allowlist

Sep 10, 2026

Commits on Sep 9, 2026

Restrict iframe embeds to an allowlist of approved providers

jeremy
authored and
rosa
committed
ff2c5bd
Bust fragment caches when the embed policy changes
jeremy
committed
38d1df2
Canonicalize configured path prefixes and reject root-equivalent ones
jeremy
committed
bde9da8
Digest the provider table in resolution order
jeremy
committed
fea5c0f
Keep tests hermetic against a per-install provider config
jeremy
committed
667878e
Make the embed allowlist opt-in, with new installs starting on the curated list
jeremy
committed
9c47640
Resolve the provider table once per configuration
jeremy
committed
4c8c3db
Parse the environment value once per configuration too
jeremy
committed
e89c1d4