fix: remove X-Frame-Options and add CSP for Storybook iframes

hectoruch · hectoruch · commit fe1549388ec4 · 2026-01-23T12:23:27.000+01:00
diff --git a/packages/storybook/vercel.json b/packages/storybook/vercel.json
@@ -15,13 +15,13 @@
           "key": "X-Content-Type-Options",
           "value": "nosniff"
         },
-        {
-          "key": "X-Frame-Options",
-          "value": "SAMEORIGIN"
-        },
         {
           "key": "X-XSS-Protection",
           "value": "1; mode=block"
+        },
+        {
+          "key": "Content-Security-Policy",
+          "value": "frame-ancestors 'self' https://*.vercel.app"
         }
       ]
     }

Original file line number	Diff line number	Diff line change
`@@ -15,13 +15,13 @@`
`15`	`15`	`"key": "X-Content-Type-Options",`
`16`	`16`	`"value": "nosniff"`
`17`	`17`	`},`
`18`		`- {`
`19`		`- "key": "X-Frame-Options",`
`20`		`- "value": "SAMEORIGIN"`
`21`		`- },`
`22`	`18`	`{`
`23`	`19`	`"key": "X-XSS-Protection",`
`24`	`20`	`"value": "1; mode=block"`
	`21`	`+ },`
	`22`	`+ {`
	`23`	`+ "key": "Content-Security-Policy",`
	`24`	`+ "value": "frame-ancestors 'self' https://*.vercel.app"`
`25`	`25`	`}`
`26`	`26`	`]`
`27`	`27`	`}`