diff options
| author | Adam Soltys <[email protected]> | 2026-10-19 22:45:31 -0700 |
|---|---|---|
| committer | Adam Soltys <[email protected]> | 2026-10-19 22:45:31 -0700 |
| commit | 6ed6cf4b85fbdbc66fa3bf81a49c8b4897ce4b7f (patch) | |
| tree | 34521d2002f8c9d24b87696f4017558e1e2b624d | |
| parent | b60a1e165d520fc54fc0c54d5b891c17a8b30f00 (diff) | |
| download | coinosv3-6ed6cf4b85fbdbc66fa3bf81a49c8b4897ce4b7f.tar.gz coinosv3-6ed6cf4b85fbdbc66fa3bf81a49c8b4897ce4b7f.zip | |
The page upgrades its insecure requests on https (CSP upgrade-insecure-requests, written in at parse time): a post's http:// clip (blossom.yakihonne.com) made Chrome mark the page not secure (displayed mixed content), and the Android app then showed the address bar and share button over it. ws:// relays go as wss:// instead of being blocked.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Claude-Session: https://claude.ai/code/session_013ZDf1cyCQLkfjftYhymZAg
| -rw-r--r-- | build.js | 5 |
1 files changed, 5 insertions, 0 deletions
@@ -393,10 +393,15 @@ const BOOT_SHELL_SCRIPT = `<script>try{var m=location.pathname.match(/^\\/([A-Za const NO_SW = !!env('NO_SW'); async function pageHtml({ css, staging, pwa, scriptHtml }) { + // On https the page asks for its http:// pictures and clips (and ws:// + // relays) over https: a post's one http:// clip made Chrome call the whole + // page "not secure" (displayed mixed content), and the Android app (a TWA) + // then showed the address bar. Not on http (local test servers). return `<!doctype html> <html lang="en"> <head> <meta charset="utf-8"> +<script>if(location.protocol==='https:')document.write('<meta http-equiv="Content-Security-Policy" content="upgrade-insecure-requests">')</script> <meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=1, interactive-widget=resizes-content"> <meta name="color-scheme" content="light dark"> <title>${staging ? 'Coinos Staging' : 'Coinos'}</title> |