Reproduction steps
- Default self-host install via install.sh script
- Go to /admin dashboard
- On Instance Configuration enter your status page url from your chosen provider
- Open self-hosted instance via web or Fluxer Desktop App
- Reload page with console open
Expected behaviour
Url should not be blocked by CSP
Actual behaviour
CORS policy causes the following error to show on console. This bug is on the official fluxer instance as well.
Build information
Canary Desktop 2026.1015.145307, Web 2026.1016.10903, Linux 7.2.10-1-cachyos (x64), Electron 44.4.1, Chrome 152.0.7977.78, Node 24.21.0, Locale en-US
Platform
Linux, Web, Self-hosting
Evidence
Access to fetch at 'https://status.example.com/summary.json' from origin 'fluxer-app://app' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.