The Content-Security-Policy is defined in next.config.ts headers(), which Next
serializes at build time, so ALLOWED_FRAME_URLS only takes effect when it is set
before `next build`. The published Docker images are built without it, so
frame-ancestors cannot be configured at runtime and iframe embedding requires a
custom image (#3793, #2407).
Move the policy into a shared getContentSecurityPolicy() and set the header from
the Docker proxy (docker/proxy.ts) on every response, where runtime env such as
CORS_MAX_AGE and DISABLE_LOGIN is already handled. next.config.ts skips the
build-time CSP when the proxy is present, so exactly one header is sent.
Non-Docker builds are unchanged: the build-time CSP still applies and
ALLOWED_FRAME_URLS keeps working as a build-time variable there.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
