3 people ca971413e9 fix(web): allow user-activated top navigation for custom home iframe (#5955) ...

The custom home page URL iframe only allows allow-forms/allow-popups/
allow-popups-to-escape-sandbox/allow-scripts, without allow-top-navigation*.
As a result, target="_top" nav/menu links inside the (admin-configured,
trusted) embedded page cannot navigate the top-level window on desktop
browsers, while some mobile browsers still allow it via allow-popups —
causing inconsistent behavior rather than an intended restriction.

Add allow-top-navigation-by-user-activation so user-clicked top-level
links work consistently across devices. This token only permits
user-activated top navigation and does NOT grant same-origin access,
so it avoids the security concern of allow-same-origin.

Co-authored-by: 贺. <kuang@M1.local>
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

2026-07-11 10:52:17 +08:00

..

classic

♻️ refactor(web): consolidate design-system primitives and responsive data views

2026-07-11 05:13:16 +08:00

default

fix(web): allow user-activated top navigation for custom home iframe (#5955)

2026-07-11 10:52:17 +08:00

bun.lock

♻️ refactor(web): consolidate design-system primitives and responsive data views

2026-07-11 05:13:16 +08:00

package.json

chore(deps): update web default dependencies

2026-07-03 16:20:22 +08:00