tweak headers

Author: dummdidumm

apps/svelte.dev/vercel.json

@@ -17,6 +17,40 @@
 					"value": "cross-origin"
 				}
 			]
+		},
+		{
+			"source": "/tutorial/(.*)\\.(.*)",
+			"headers": [
+				{
+					"key": "cross-origin-opener-policy",
+					"value": "same-origin"
+				},
+				{
+					"key": "cross-origin-embedder-policy",
+					"value": "require-corp"
+				},
+				{
+					"key": "cross-origin-resource-policy",
+					"value": "cross-origin"
+				}
+			]
+		},
+		{
+			"source": "/svelte-logo(.*)",
+			"headers": [
+				{
+					"key": "cross-origin-opener-policy",
+					"value": "same-origin"
+				},
+				{
+					"key": "cross-origin-embedder-policy",
+					"value": "require-corp"
+				},
+				{
+					"key": "cross-origin-resource-policy",
+					"value": "cross-origin"
+				}
+			]
 		}
 	]
 }

apps/svelte.dev/vite.config.ts

@@ -6,7 +6,8 @@ import browserslist from 'browserslist';
 
 const plugins: PluginOption[] = [
 	enhancedImages(),
-	// apply cross-origin isolation headers for tutorial when previewing locally
+	// apply cross-origin isolation headers for tutorial when developing/previewing locally,
+	// else web containers don't work and images don't load in the rollup iframe
 	{
 		name: 'cross-origin-isolation-for-preview',
 		configurePreviewServer: (server) => {
@@ -16,6 +17,14 @@ const plugins: PluginOption[] = [
 				res.setHeader('cross-origin-resource-policy', 'cross-origin');
 				next();
 			});
+		},
+		configureServer: (server) => {
+			server.middlewares.use((_, res, next) => {
+				res.setHeader('cross-origin-opener-policy', 'same-origin');
+				res.setHeader('cross-origin-embedder-policy', 'require-corp');
+				res.setHeader('cross-origin-resource-policy', 'cross-origin');
+				next();
+			});
 		}
 	},
 	sveltekit() as PluginOption
@@ -50,7 +59,7 @@ const config: UserConfig = {
 	},
 	server: {
 		fs: { allow: ['../../packages', '../../../KIT/kit/packages/kit'] },
-		// for tutorial
+		// for SvelteKit tutorial
 		headers: {
 			'cross-origin-opener-policy': 'same-origin',
 			'cross-origin-embedder-policy': 'require-corp',