From 8e25dd88e8450810dffc3349c1258902ba8ff1d1 Mon Sep 17 00:00:00 2001
From: talatops <cybertech75@proton.me>
Date: Thu, 2 Apr 2026 21:57:26 +0500
Subject: [PATCH] fix(storefront-chat): allow widget iframe embedding via CSP
 frame-ancestors

Shopify storefronts embed the chat widget cross-origin; Firefox blocks
unless the response allows framing. Set Content-Security-Policy with
frame-ancestors * for /storefront-chat/widget routes.

Made-with: Cursor
---
 next.config.ts | 19 +++++++++++++++++++
 1 file changed, 19 insertions(+)

diff --git a/next.config.ts b/next.config.ts
index ac288db..43725a7 100644
--- a/next.config.ts
+++ b/next.config.ts
@@ -1,7 +1,26 @@
 import type { NextConfig } from "next";
 
+/** Lets Shopify / custom domains embed the public widget in an iframe (Firefox blocks without this). */
+const STOREFRONT_WIDGET_CSP = "frame-ancestors *";
+
 const nextConfig: NextConfig = {
   /* config options here */
+  async headers() {
+    return [
+      {
+        source: "/storefront-chat/widget",
+        headers: [
+          { key: "Content-Security-Policy", value: STOREFRONT_WIDGET_CSP },
+        ],
+      },
+      {
+        source: "/storefront-chat/widget/:path*",
+        headers: [
+          { key: "Content-Security-Policy", value: STOREFRONT_WIDGET_CSP },
+        ],
+      },
+    ];
+  },
   // Keep Prisma + pg as Node externals so Turbopack does not bundle the
   // generated client (fixes "Cannot read properties of undefined (reading 'graph')"
   // during `next build` in some Docker/Linux environments).