[GH-ISSUE #22] Clicking on URL raises "Content Security Policy «frame-src»" error #21

New issue

Closed

opened 2026-03-15 12:08:11 +03:00 by kerem · 2 comments

kerem commented

2026-03-15 12:08:11 +03:00

Owner

Originally created by @antonkomarev on GitHub (Nov 17, 2022).
Original GitHub issue: https://github.com/axllent/mailpit/issues/22

When clicking on URL in email we are getting CSP error in console (and link not opening).

Content Security Policy: Page parameters blocked resource loading http://example.com/email-verification/4a7449fbefbc5280dc50e0025c366fd8 («frame-src»).

This issue could be solved by force open all links in new tab.

Originally created by @antonkomarev on GitHub (Nov 17, 2022). Original GitHub issue: https://github.com/axllent/mailpit/issues/22 When clicking on URL in email we are getting CSP error in console (and link not opening). > Content Security Policy: Page parameters blocked resource loading http://example.com/email-verification/4a7449fbefbc5280dc50e0025c366fd8 («frame-src»). This issue could be solved by force open all links in new tab.

kerem

2026-03-15 12:08:11 +03:00

closed this issue
added the
bug
label

kerem commented

2026-03-15 12:08:27 +03:00

Author

Owner

@axllent commented on GitHub (Nov 17, 2022):

Thanks for raising this @antonkomarev - it used to work fine and in the last release I managed to break it :) All links in an email should get the target="_blank" appended to them via JavaScript after the iframe loads, but this is firing too quickly before the DOM has loaded (due to the last change). I will fix this very soon.

@axllent commented on GitHub (Nov 17, 2022): Thanks for raising this @antonkomarev - it used to work fine and in the last release I managed to break it :) All links in an email should get the `target="_blank"` appended to them via JavaScript after the iframe loads, but this is firing too quickly before the DOM has loaded (due to the last change). I will fix this very soon.

kerem commented

2026-03-15 12:08:32 +03:00

Author

Owner

@axllent commented on GitHub (Nov 18, 2022):

Thanks again for the bug report. This has been fixed in v1.2.9 👍

@axllent commented on GitHub (Nov 18, 2022): Thanks again for the bug report. This has been fixed in v1.2.9 :+1: