From cb91fb9df84445e85877bb2ffab40e1310c0ce9f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Samy=20Pess=C3=A9?= <samypesse@gmail.com>
Date: Thu, 29 Feb 2024 11:24:55 +0100
Subject: [PATCH] Fix access to cookies when used in iframe (#202)

* Fix access to cookies when used in iframe

* Allow https: embed
---
 src/lib/csp.ts    |  2 +-
 src/middleware.ts | 20 ++++++++++++--------
 2 files changed, 13 insertions(+), 9 deletions(-)

diff --git a/src/lib/csp.ts b/src/lib/csp.ts
index 37d4c8544..1955469e5 100644
--- a/src/lib/csp.ts
+++ b/src/lib/csp.ts
@@ -50,7 +50,7 @@ export function getContentSecurityPolicy(scripts: SpaceIntegrationScript[], nonc
         object-src 'none';
         base-uri 'self' ${assetsDomain};
         form-action 'self' ${assetsDomain};
-        frame-ancestors 'none';
+        frame-ancestors  https:;
     `;
 
     const result = scripts
diff --git a/src/middleware.ts b/src/middleware.ts
index 58693689f..50df0a39d 100644
--- a/src/middleware.ts
+++ b/src/middleware.ts
@@ -53,17 +53,19 @@ type URLLookupMode =
      */
     | 'multi-id';
 
+export type LookupCookies = Record<
+    string,
+    {
+        value: string;
+        options?: Partial<ResponseCookie>;
+    }
+>;
+
 export type LookupResult = PublishedContentWithCache & {
     /** API endpoint to use for the content post lookup */
     apiEndpoint?: string;
     /** Cookies to store on the response */
-    cookies?: Record<
-        string,
-        {
-            value: string;
-            options?: Partial<ResponseCookie>;
-        }
-    >;
+    cookies?: LookupCookies;
 };
 
 /**
@@ -377,12 +379,14 @@ async function lookupSpaceInMultiIdMode(request: NextRequest, url: URL): Promise
         () => getSpace.revalidate(spaceId),
     );
 
-    const cookies = {
+    const cookies: LookupCookies = {
         [cookieName]: {
             value: encodeGitBookTokenCookie(spaceId, apiToken, apiEndpoint),
             options: {
                 httpOnly: true,
                 maxAge: 60 * 30,
+                secure: process.env.NODE_ENV === 'production',
+                sameSite: 'none',
             },
         },
     };