From ff567ee260ddf821a89349b384586d12dab2c474 Mon Sep 17 00:00:00 2001 From: shipeasy-ai Date: Tue, 16 Jun 2026 10:12:47 -0400 Subject: [PATCH] CSP: allow multiple space-separated EMBED_ALLOWED_ORIGIN values The embedding EHR spans an apex plus an app/tenant subdomain; frame-ancestors must list each origin separately. Split EMBED_ALLOWED_ORIGIN on whitespace so "https://enwella.com https://app.enwella.com" both become sources. The deploy already sets two space-separated origins; the single-value form emitted one malformed token and the browser blocked the iframe. --- app/controllers/application_controller.rb | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) diff --git a/app/controllers/application_controller.rb b/app/controllers/application_controller.rb index d5db8f27..03218cf9 100644 --- a/app/controllers/application_controller.rb +++ b/app/controllers/application_controller.rb @@ -147,10 +147,14 @@ class ApplicationController < ActionController::Base policy.directives['connect-src'] << 'ws:' if Rails.env.development? - # Allow the embedding app (set via EMBED_ALLOWED_ORIGIN) to iframe - # this DocuSeal instance. Required by the self-hosted JWT shim in - # `embed_scripts_controller.rb`. - policy.frame_ancestors :self, ENV['EMBED_ALLOWED_ORIGIN'] if ENV['EMBED_ALLOWED_ORIGIN'].present? + # Allow the embedding app(s) to iframe this DocuSeal instance. Required + # by the self-hosted JWT embed (embed_scripts_controller.rb + the + # token-auth EmbedBuilderController). EMBED_ALLOWED_ORIGIN may list + # several space-separated origins (e.g. an apex plus an app subdomain: + # "https://example.com https://app.example.com") — each becomes its own + # frame-ancestors source. + embed_origins = ENV['EMBED_ALLOWED_ORIGIN'].to_s.split + policy.frame_ancestors(:self, *embed_origins) if embed_origins.any? end end end