diff --git a/packages/frontend/core/src/blocksuite/view-extensions/code-block-preview/html-preview.ts b/packages/frontend/core/src/blocksuite/view-extensions/code-block-preview/html-preview.ts
index 223a44c83d..cf149a4e96 100644
--- a/packages/frontend/core/src/blocksuite/view-extensions/code-block-preview/html-preview.ts
+++ b/packages/frontend/core/src/blocksuite/view-extensions/code-block-preview/html-preview.ts
@@ -67,11 +67,6 @@ export class HTMLPreview extends SignalWatcher(WithDisposable(LitElement)) {
   override firstUpdated(_changedProperties: PropertyValues): void {
     const result = super.firstUpdated(_changedProperties);
 
-    if (!window.crossOriginIsolated) {
-      this.state = 'fallback';
-      return;
-    }
-
     this._link();
 
     this.disposables.add(
diff --git a/packages/frontend/core/src/blocksuite/view-extensions/code-block-preview/iframe-container.ts b/packages/frontend/core/src/blocksuite/view-extensions/code-block-preview/iframe-container.ts
index c0043d5c41..e2b40143e6 100644
--- a/packages/frontend/core/src/blocksuite/view-extensions/code-block-preview/iframe-container.ts
+++ b/packages/frontend/core/src/blocksuite/view-extensions/code-block-preview/iframe-container.ts
@@ -3,5 +3,5 @@ import type { CodeBlockModel } from '@blocksuite/affine/model';
 export function linkIframe(iframe: HTMLIFrameElement, model: CodeBlockModel) {
   const html = model.props.text.toString();
   iframe.srcdoc = html;
-  iframe.sandbox.add('allow-scripts');
+  iframe.sandbox.add('allow-scripts', 'allow-same-origin');
 }
diff --git a/tools/cli/src/bundle.ts b/tools/cli/src/bundle.ts
index 92957d8021..3efb790688 100644
--- a/tools/cli/src/bundle.ts
+++ b/tools/cli/src/bundle.ts
@@ -125,20 +125,6 @@ const defaultDevServerConfig: DevServerConfiguration = {
       },
     ],
   },
-  headers: (req): Record<string, string | string[]> => {
-    if (
-      [/^\/api/, /^\/socket\.io/, /^\/graphql/].some(path =>
-        path.test(req.path)
-      )
-    ) {
-      return {};
-    }
-
-    return {
-      'Cross-Origin-Opener-Policy': 'same-origin',
-      'Cross-Origin-Embedder-Policy': 'require-corp',
-    };
-  },
   proxy: [
     {
       context: '/api',