From 6ed6cf4b85fbdbc66fa3bf81a49c8b4897ce4b7f Mon Sep 17 00:00:00 2001
From: Adam Soltys <adam@coinos.io>
Date: Mon, 19 Oct 2026 22:45:31 -0700
Subject: The page upgrades its insecure requests on https (CSP
 upgrade-insecure-requests, written in at parse time): a post's http:// clip
 (blossom.yakihonne.com) made Chrome mark the page not secure (displayed mixed
 content), and the Android app then showed the address bar and share button
 over it. ws:// relays go as wss:// instead of being blocked.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013ZDf1cyCQLkfjftYhymZAg
---
 build.js | 5 +++++
 1 file changed, 5 insertions(+)

(limited to 'build.js')

diff --git a/build.js b/build.js
index 6a10eda..bac1079 100644
--- a/build.js
+++ b/build.js
@@ -393,10 +393,15 @@ const BOOT_SHELL_SCRIPT = `<script>try{var m=location.pathname.match(/^\\/([A-Za
 const NO_SW = !!env('NO_SW');
 
 async function pageHtml({ css, staging, pwa, scriptHtml }) {
+  // On https the page asks for its http:// pictures and clips (and ws://
+  // relays) over https: a post's one http:// clip made Chrome call the whole
+  // page "not secure" (displayed mixed content), and the Android app (a TWA)
+  // then showed the address bar. Not on http (local test servers).
   return `<!doctype html>
 <html lang="en">
 <head>
 <meta charset="utf-8">
+<script>if(location.protocol==='https:')document.write('<meta http-equiv="Content-Security-Policy" content="upgrade-insecure-requests">')</script>
 <meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=1, interactive-widget=resizes-content">
 <meta name="color-scheme" content="light dark">
 <title>${staging ? 'Coinos Staging' : 'Coinos'}</title>
-- 
cgit v1.2.3