From da980876cb51799b8b47706c29ea0725666a376e Mon Sep 17 00:00:00 2001
From: Peng Xiao <pengxiao@outlook.com>
Date: Fri, 20 Jun 2025 18:19:28 +0800
Subject: [PATCH] fix(core): iframe rendering issue for youtube videos (#12880)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

#### PR Dependency Tree


* **PR #12880** 👈

This tree was auto-generated by
[Charcoal](https://github.com/danerwilliams/charcoal)

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

- **Bug Fixes**
- Improved iframe preview behavior for code blocks, enabling enhanced
compatibility and resource access within previews.
- **Chores**
- Updated internal server configuration to no longer set custom
cross-origin headers during development.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---
 .../code-block-preview/html-preview.ts             |  5 -----
 .../code-block-preview/iframe-container.ts         |  2 +-
 tools/cli/src/bundle.ts                            | 14 --------------
 3 files changed, 1 insertion(+), 20 deletions(-)

diff --git a/packages/frontend/core/src/blocksuite/view-extensions/code-block-preview/html-preview.ts b/packages/frontend/core/src/blocksuite/view-extensions/code-block-preview/html-preview.ts
index 223a44c83d..cf149a4e96 100644
--- a/packages/frontend/core/src/blocksuite/view-extensions/code-block-preview/html-preview.ts
+++ b/packages/frontend/core/src/blocksuite/view-extensions/code-block-preview/html-preview.ts
@@ -67,11 +67,6 @@ export class HTMLPreview extends SignalWatcher(WithDisposable(LitElement)) {
   override firstUpdated(_changedProperties: PropertyValues): void {
     const result = super.firstUpdated(_changedProperties);
 
-    if (!window.crossOriginIsolated) {
-      this.state = 'fallback';
-      return;
-    }
-
     this._link();
 
     this.disposables.add(
diff --git a/packages/frontend/core/src/blocksuite/view-extensions/code-block-preview/iframe-container.ts b/packages/frontend/core/src/blocksuite/view-extensions/code-block-preview/iframe-container.ts
index c0043d5c41..e2b40143e6 100644
--- a/packages/frontend/core/src/blocksuite/view-extensions/code-block-preview/iframe-container.ts
+++ b/packages/frontend/core/src/blocksuite/view-extensions/code-block-preview/iframe-container.ts
@@ -3,5 +3,5 @@ import type { CodeBlockModel } from '@blocksuite/affine/model';
 export function linkIframe(iframe: HTMLIFrameElement, model: CodeBlockModel) {
   const html = model.props.text.toString();
   iframe.srcdoc = html;
-  iframe.sandbox.add('allow-scripts');
+  iframe.sandbox.add('allow-scripts', 'allow-same-origin');
 }
diff --git a/tools/cli/src/bundle.ts b/tools/cli/src/bundle.ts
index 92957d8021..3efb790688 100644
--- a/tools/cli/src/bundle.ts
+++ b/tools/cli/src/bundle.ts
@@ -125,20 +125,6 @@ const defaultDevServerConfig: DevServerConfiguration = {
       },
     ],
   },
-  headers: (req): Record<string, string | string[]> => {
-    if (
-      [/^\/api/, /^\/socket\.io/, /^\/graphql/].some(path =>
-        path.test(req.path)
-      )
-    ) {
-      return {};
-    }
-
-    return {
-      'Cross-Origin-Opener-Policy': 'same-origin',
-      'Cross-Origin-Embedder-Policy': 'require-corp',
-    };
-  },
   proxy: [
     {
       context: '/api',