From 935c53397b36431d8285091ec19f854a810f6940 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Sune=20M=C3=B8lgaard=20Laursen?= Date: Tue, 14 Jul 2026 13:00:42 +0200 Subject: [PATCH 1/2] delta allowed frame ancestor --- next.config.mjs | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/next.config.mjs b/next.config.mjs index 2849296..cc487d8 100644 --- a/next.config.mjs +++ b/next.config.mjs @@ -40,6 +40,17 @@ const nextConfig = { ], headers: async () => { const headers = [ + { + // Anti-clickjacking: only GoodWallet itself and delta may iframe us. + // The delta mobile app uses a native WebView (top-level document), which frame-ancestors does not affect. + source: "/:path*", + headers: [ + { + key: "Content-Security-Policy", + value: "frame-ancestors 'self' https://*.delta.app", + }, + ], + }, { //Allow browsers to cache content from public folder for one week, to cut down on the number of edge requests source: "/:all*(.png|.jpg|.jpeg|.gif|.svg|.ico|.webp|.webmanifest)", From af19d8116a23e9716bc7f7299419fafa41037dc9 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Sune=20M=C3=B8lgaard=20Laursen?= <88385740+sunela-tr@users.noreply.github.com> Date: Tue, 14 Jul 2026 13:45:29 +0200 Subject: [PATCH 2/2] Potential fix for pull request finding MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> Signed-off-by: Sune Mølgaard Laursen <88385740+sunela-tr@users.noreply.github.com> --- next.config.mjs | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/next.config.mjs b/next.config.mjs index cc487d8..38bfdd4 100644 --- a/next.config.mjs +++ b/next.config.mjs @@ -47,7 +47,7 @@ const nextConfig = { headers: [ { key: "Content-Security-Policy", - value: "frame-ancestors 'self' https://*.delta.app", + value: "frame-ancestors 'self' https://delta.app https://*.delta.app;", }, ], },