From 2a24af63f50e4382cbc7d5e8ea94215ce2db1ec8 Mon Sep 17 00:00:00 2001 From: mauriceboe Date: Fri, 3 Jul 2026 18:44:42 +0200 Subject: [PATCH] fix(plugins): exclude /plugin-frame/ from the service-worker navigate fallback MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The PWA service worker's navigateFallback served the SPA shell for any navigation not on its denylist. /plugin-frame/ wasn't listed, so the SW intercepted the sandboxed opaque-origin plugin iframe navigation, which Chrome reports as 'Unsafe attempt to load URL … from frame with URL …'. Denylist it so plugin frames are served straight from the network. --- client/vite.config.js | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/client/vite.config.js b/client/vite.config.js index 35f486b87..6cdcfe889 100644 --- a/client/vite.config.js +++ b/client/vite.config.js @@ -11,7 +11,7 @@ export default defineConfig({ maximumFileSizeToCacheInBytes: 10 * 1024 * 1024, globPatterns: ['**/*.{js,css,html,svg,png,woff,woff2,ttf}'], navigateFallback: 'index.html', - navigateFallbackDenylist: [/^\/api/, /^\/uploads/, /^\/mcp/, /^\/oauth\//, /^\/.well-known\//], + navigateFallbackDenylist: [/^\/api/, /^\/uploads/, /^\/mcp/, /^\/oauth\//, /^\/.well-known\//, /^\/plugin-frame\//], runtimeCaching: [ { // Carto map tiles (default provider)