chore(youtube): enumerate parent origins in api/youtube/embed.js and fix its stale doc entry

Open

#8,177 opened on Sep 15, 2026 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

chore security

Dominant language: TypeScript
Stars: 87k
Forks: 13.2k
Avg merge: 8h 4m
Merged PRs (30d): 825

Description

## Why

`api/youtube/embed.js:13-22` still matches `^https:\/\/(.*\.)?worldmonitor\.app$`. It is the last suffix match on that domain. `convex/payments/returnUrlOrigin.ts:11-16` enumerates app hosts because `clerk.` and `abacus.` are vendor CNAMEs, and #8171 applies the same enumeration to CORS.

Probe on 2026-09-15: `embed.js` accepts `https://abacus.worldmonitor.app`, `https://clerk.worldmonitor.app`, and `https://anything-future.worldmonitor.app` as `parentOrigin`. `isTrustedReturnUrlOrigin` refuses all three.

## Why this is hygiene, not a vulnerability

The deployed route answers with `frame-ancestors` enumerated to the app hosts and `x-frame-options: SAMEORIGIN`, so a vendor page cannot frame the wrapper. The route has no production caller. Web embeds youtube.com directly (`src/components/LiveWebcamsPanel.ts:329`) and desktop uses the sidecar (`LiveWebcamsPanel.ts:326`, `src-tauri/sidecar/local-api-server.mjs:1497`).

## Do

1. Replace the suffix regex with the enumerated app origins (or import `TRUSTED_RETURN_URL_ORIGINS`). Keep the team-pinned preview pattern and the localhost and tauri entries.
2. Fix `docs/api-notifications.mdx:97`. It says the route exists "to bypass WKWebView autoplay restrictions on the desktop app", which the sidecar route does.
3. Decide whether to retire the hosted route. `api/api-route-exceptions.json:483` and `shared/source-attribution-manifest.json` list it.

Found during the 2026-09-15 security-validation batch (YoutubeEmbedParentOriginVendorCnameSuffix outcome, closed no-change).

Contributor guide

Open the contributing guide

First steps

Read the whole issue, then the project's contributing guide.
Comment on the issue to say you are picking it up — it saves two people doing the same work.
Fork the repository and make your change on a branch.
Open a pull request that references the issue number.

Research direction

Start with api/youtube/embed.js:13-22 and compare its allowed origins with convex/payments/returnUrlOrigin.ts:11-16, keeping the preview, localhost, and tauri entries in scope. Update docs/api-notifications.mdx:97 and review api/api-route-exceptions.json:483 plus shared/source-attribution-manifest.json before deciding whether the hosted route should remain; done means the origin policy and documentation agree.

Written by the indexing model from the issue text.

Assessment

Tech stack: javascript, typescript
Domain: api, documentation, security
Issue type: Refactor
Difficulty: 4/5
Estimated time: 3-5 days
Activity status: Active
Clarity: Mostly clear
Newbie friendliness: 48/100