From 7f6a7137d13a028330db0db792c148b149e1cf13 Mon Sep 17 00:00:00 2001 From: Mark Dumay <61946753+markdumay@users.noreply.github.com> Date: Mon, 13 Jul 2026 13:23:26 +0200 Subject: [PATCH] feat(csp): declare the frame-src sources the preview reference needs MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The preview block reference embeds a Wikipedia article and an OpenStreetMap map to demonstrate a live preview. Neither host is covered by a consuming site's default CSP, so the browser blocked both iframes and the page rendered two empty boxes on every site shipping this content, including demo.gethinode.com and gethinode.com. Declare the two sources through [params.modules.docs.csp], the same way mod-leaflet declares tile.openstreetmap.org for its own img-src. Consuming sites now inherit them rather than hand-maintaining the list, which is how the two sites drifted apart in the first place. The reference also previews google.com on purpose, to demonstrate a site that refuses to be framed. It sends X-Frame-Options: SAMEORIGIN and cannot be embedded at all, so it needs no frame-src source and correctly falls back to a screenshot. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.8 (1M context) --- hugo.toml | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/hugo.toml b/hugo.toml index a523c02..f9d90cc 100644 --- a/hugo.toml +++ b/hugo.toml @@ -21,6 +21,17 @@ [params.links] hugo_docs = "https://gohugo.io/documentation/" +[params.modules.docs.csp] + # The preview block reference embeds these sites to demonstrate a live preview. Without + # them a consuming site's CSP blocks the iframes and the page shows empty boxes. The + # reference also previews google.com on purpose, to show a site that refuses to be framed; + # that one falls back to a screenshot and needs no source. + frame-src = [ + "*.wikipedia.org", + "www.openstreetmap.org" + ] + + [menus] [[menus.sample]] name = "Blog"