Skip to content

HOTFIX: Revert CSP headers — breaks Farcaster miniapp completely #748

@realproject7

Description

@realproject7

CRITICAL — Farcaster miniapp is completely broken

PR #747 added CSP headers to `next.config.ts` to fix WalletConnect console warnings. This broke the Farcaster miniapp entirely — the page won't load because:

  1. `frame-ancestors` blocks Warpcast from framing PlotLink (bare `warpcast.com` not in the wildcard `*.warpcast.com`)
  2. `connect-src` blocks Privy auth, Warpcast client, wrpcd.net, and other Farcaster infrastructure domains

Root cause

Before PR #747, there were no CSP headers — browsers allow everything by default. The WalletConnect console errors were from Farcaster's own CSP, not PlotLink's. Adding our own CSP created an allowlist that missed critical domains.

Neither Dropcast nor MintPad use CSP headers — both work fine without them.

Fix

Revert `next.config.ts` to have no CSP headers:

```typescript
import type { NextConfig } from "next";

const nextConfig: NextConfig = {
/* config options here */
};

export default nextConfig;
```

What to check before reverting

PR #747 only modified `next.config.ts` — no other files. Safe to revert just this file.

Verify that no other PR in the same batch added config to `next.config.ts` that should be kept. Check:

Branch

`task/748-revert-csp`

Self-Verification (T3)

  • `next.config.ts` has no CSP headers
  • Farcaster miniapp loads correctly in Warpcast
  • Regular browser (desktop) works
  • RainbowKit wallet picker still works
  • `npm run build` passes
  • Deploy and verify on plotlink.xyz

Metadata

Metadata

Assignees

No one assigned

    Labels

    agent/T3Assigned to T3 builder agent

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions