Max Peintner 39c76a94a8 fix(login): CSP img-src to allow instance assets (#10579) ...

Fix CSP img-src to allow ZITADEL instance assets

# Which Problems Are Solved

Login app was failing to load images (logos, branding assets) from
ZITADEL instances due to Content Security Policy restrictions. The CSP
img-src directive only allowed 'self' and https://vercel.com, blocking
images from ZITADEL domains like https://login-*.zitadel.app.

# How the Problems Are Solved

- Dynamic CSP configuration: Extract hostname from ZITADEL_API_URL
environment variable
- Fallback support: Use *.zitadel.cloud wildcard when no specific URL is
configured
- Environment-aware: Works across dev/staging/prod without hardcoded
domains

(cherry picked from commit 6699a6f966)

2025-08-28 09:22:56 +02:00

..

login

fix(login): CSP img-src to allow instance assets (#10579)

2025-08-28 09:22:56 +02:00