From d047bd052ec86203c355cbc82f2775db85e5903d Mon Sep 17 00:00:00 2001
From: Abdullah Atta <abdullahatta@streetwriters.co>
Date: Mon, 19 Jan 2026 08:57:50 +0500
Subject: [PATCH] cors: add headers to allow the YouTube embed wrapper to be
 displayed in an iframe

---
 cors-proxy/src/index.ts | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/cors-proxy/src/index.ts b/cors-proxy/src/index.ts
index 1dc837c..74196be 100644
--- a/cors-proxy/src/index.ts
+++ b/cors-proxy/src/index.ts
@@ -218,6 +218,8 @@ const server = Bun.serve({
         status: 200,
         headers: {
           "Content-Type": "text/html; charset=utf-8",
+          "Content-Security-Policy": "frame-ancestors *",
+          "X-Frame-Options": "ALLOWALL",
         },
       });
     }