Originally posted by chadberg July 20, 2026
I use a Firefox extension to load my dashboard webapp in new tabs. This webapp is fully and properly set up with VoidAuth for OIDC. But when I load it with the extension, it has a moz-extension:// URL as its origin instead of the URL of the dashboard. This triggers VoidAuth's CSP and I cannot log in directly. The workaround is to load the URL for the dashboard manually, but if I could add the moz-extension:// URL to a list of trusted frame-ancestors, it would load in the new tab properly. Any thoughts on opening up a way to add to the frame-ancestors CSP list?
Discussed in https://github.com/orgs/voidauth/discussions/511
Originally posted by chadberg July 20, 2026
I use a Firefox extension to load my dashboard webapp in new tabs. This webapp is fully and properly set up with VoidAuth for OIDC. But when I load it with the extension, it has a moz-extension:// URL as its origin instead of the URL of the dashboard. This triggers VoidAuth's CSP and I cannot log in directly. The workaround is to load the URL for the dashboard manually, but if I could add the moz-extension:// URL to a list of trusted frame-ancestors, it would load in the new tab properly. Any thoughts on opening up a way to add to the frame-ancestors CSP list?