allow any frame ancestor in dev (github#34109)

DaleMckeown · Jan 24, 2023 · 0ffbb52 · 0ffbb52
1 parent a9cddcf
commit 0ffbb52
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/middleware/helmet.js b/middleware/helmet.js
@@ -40,7 +40,7 @@ const DEFAULT_OPTIONS = {
         isDev && 'http://localhost:3000',
         'https://www.youtube-nocookie.com',
       ].filter(Boolean),
-      frameAncestors: [...GITHUB_DOMAINS],
+      frameAncestors: isDev ? ['*'] : [...GITHUB_DOMAINS],
       styleSrc: ["'self'", "'unsafe-inline'", 'data:', AZURE_STORAGE_URL],
       childSrc: ["'self'"], // exception for search in deprecated GHE versions
       upgradeInsecureRequests: isDev ? null : [],