@botfabrik/engine-webclient 4.109.12-alpha.0 → 4.109.12-alpha.2

package/dist/index.js

@@ -75,6 +75,10 @@ export default (clientName, environment, props) => async (bot) => {
                 frameAncestors: allowedOrigins === undefined
                     ? ['*']
                     : ["'self'", ...allowedOrigins],
+                // frame-src controls what this page may embed in an iframe.
+                // The /embed page loads the chatbot in an iframe on the same server ('self').
+                // When allowedOrigins are set, those must also be allowed (e.g. standalone view).
+                frameSrc: ["'self'", ...(allowedOrigins ?? [])],
                 objectSrc: ["'none'"], // disable Flash/plugins
                 baseUri: ["'self'"], // prevent <base>-tag injection
                 // When SAML auth is configured, the browser POSTs a form to the external IdP.
@@ -92,6 +96,10 @@ export default (clientName, environment, props) => async (bot) => {
         frameguard: false,
         // Send origin only, without path – sufficient for analytics while avoiding leaking URLs
         referrerPolicy: { policy: 'strict-origin-when-cross-origin' },
+        // Disable HSTS: HTTPS enforcement is already handled globally in engine-core.
+        // Enabling it here would cause the browser to enforce HTTPS for the entire origin,
+        // which breaks local development (http://localhost:3000).
+        hsts: false,
         // resources served by the webclient must be loadable cross-origin (e.g. embed script)
         crossOriginResourcePolicy: { policy: 'cross-origin' },
     }));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@botfabrik/engine-webclient",
-  "version": "4.109.12-alpha.0",
+  "version": "4.109.12-alpha.2",
   "description": "Webclient for Botfabriks Bot Engine",
   "type": "module",
   "main": "./dist/index.js",
@@ -53,5 +53,5 @@
     "tsx": "^4.21.0",
     "typescript": "5.9.3"
   },
-  "gitHead": "49afbc154f2bdd31c5cb2a8c9c6d605959f538bf"
+  "gitHead": "0706d247f9232a5a70742a082e0f3177ed182609"
 }