The page upgrades its insecure requests on https (CSP upgrade-insecure-requests, written in at parse time): a post's http:// clip (blossom.yakihonne.com) made Chrome mark the page not secure (displayed mixed content), and the Android app then showed the address bar and share button over it. ws:// relays go as wss:// instead of being blocked.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
Claude-Session: https://claude.ai/code/session_013ZDf1cyCQLkfjftYhymZAg

1 files changed, 5 insertions, 0 deletions

diff --git a/build.js b/build.js
index 6a10eda..bac1079 100644
--- a/build.js
+++ b/build.js
@@ -393,10 +393,15 @@ const BOOT_SHELL_SCRIPT = `<script>try{var m=location.pathname.match(/^\\/([A-Za
 const NO_SW = !!env('NO_SW');
 
 async function pageHtml({ css, staging, pwa, scriptHtml }) {
+  // On https the page asks for its http:// pictures and clips (and ws://
+  // relays) over https: a post's one http:// clip made Chrome call the whole
+  // page "not secure" (displayed mixed content), and the Android app (a TWA)
+  // then showed the address bar. Not on http (local test servers).
   return `<!doctype html>
 <html lang="en">
 <head>
 <meta charset="utf-8">
+<script>if(location.protocol==='https:')document.write('<meta http-equiv="Content-Security-Policy" content="upgrade-insecure-requests">')</script>
 <meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=1, interactive-widget=resizes-content">
 <meta name="color-scheme" content="light dark">
 <title>${staging ? 'Coinos Staging' : 'Coinos'}</title>