Header compatibility: CSP / COOP / COEP / frame-ancestors

Summary

Strict security headers (CSP, COOP, COEP, and frame-ancestors) cause Base miniapps to fail when loaded inside the Base Dev wireframe or Coinbase Wallet container.

After manual testing, we found required origins and directives are undocumented, which complicates secure integration.

Observed issues

Area | Problem | Notes
-- | -- | --
frame-ancestors | Base Dev and Base App blocked when 'self' or 'none' | Works only after adding specific Base origins
CSP | SDKs, RPC, and bridge requests blocked | Manual whitelisting required
COOP / COEP | Isolation breaks iframe execution | Container likely not COEP-compatible
Permissions-Policy | Notifications blocked | Need explicit allowlist for Base origins

Requested improvements

1. 
   

   Add official documentation for required headers and origins.

   
   


2. 
   

   Provide an authoritative list of Base Dev / Base App / SDK / RPC origins.

   
   


3. 
   

   Clarify COOP/COEP support status for Base containers.

   
   


4. 
   

   Include an example “secure but compatible” CSP configuration.

   
   


5. 
   

   Add a short compatibility matrix (Dev vs Prod origins).

   
   

Environment

• 
  

  Next.js 14 + SSR proxy (k8s + Cloudflare)

  
  


• 
  

  Full CSP, COOP/COEP enabled

  
  


• 
  

  SDKs: @farcaster/miniapp-sdk==^0.2.0, @coinbase/onchainkit==^1.1.1

  
  


• 
  

  Affected surfaces: Base Dev wireframe, Coinbase Wallet webview

  
  

Note: Original issue was enhanced with AI Agent