[E30-S04-T01] CSP frame-src from provider table #314

New Issue

2026-08-27T08:05:19Z

kpcto commented

2026-08-27 08:05:19 +00:00

Parent story: [E30-S04] CSP frame-src generation from the provider table (#119)

Intent

Generate the CSP frame-src directive from the provider table.

Acceptance criteria

Generate the CSP frame-src directive from the eppp_embed_providers table
Ensure an iframe from a non-allowlisted host is blocked by the browser and the renderer

Explicitly out of scope

Provider allowlist administration is covered by E30-S02

Test plan

Assert frame-src lists only allowlisted hostnames and a foreign iframe is blocked

Rollback note

Revert the CSP generation; no data change

Owning stream

platform

Risk quadrant

agent-full

> Parent story: [E30-S04] CSP frame-src generation from the provider table (#119) ## Intent Generate the CSP `frame-src` directive from the provider table. ## Acceptance criteria - Generate the CSP `frame-src` directive from the `eppp_embed_providers` table - Ensure an iframe from a non-allowlisted host is blocked by the browser and the renderer ## Explicitly out of scope - Provider allowlist administration is covered by E30-S02 ## Test plan - Assert `frame-src` lists only allowlisted hostnames and a foreign iframe is blocked ## Rollback note - Revert the CSP generation; no data change ### Owning stream platform ### Risk quadrant agent-full

kpcto added this to the Sprint M milestone 2026-08-27 08:05:19 +00:00

kpcto added the

labels 2026-08-27 08:05:19 +00:00

Sign in to join this conversation.