- Shipped
- August 5, 2026 at 9:05 PM UTC
- Author
- kamo
- Commit
- 681cfc3
/network is the one page that renders another tenant's branding: it lists every organization in the network and loads each logo from that org's own theme.<domain> asset origin. The page-level img-src policy written by proxy.ts names only the tenant the request arrived on, deliberately, so every foreign origin was blocked, the <img> fired error, and the card fell back to an initial. The only logo that survived was the one belonging to the current domain, which read as "logos are broken" rather than "the policy is doing its job". Confirmed against prod: all eight orgs with a logo have the object in MinIO, every theme.<domain> resolves, and each URL returns 200 when fetched directly — the browser was refusing to load them, not the origin failing to serve them. Routed through safeImageSrc like every other foreign image, so they become same-origin /api/images/proxy requests that the policy's 'self' already permits. Widening img-src was the alternative and the wrong one: it would mean naming every customer domain, which the policy cannot know and which grows with each new org.