Waffle

¿Es tu juego?

Haz que se pueda jugar aquí mismo en Gamesdle. Copia este prompt en tu agente de programación con IA (Claude Code, Cursor, Copilot y similares) o envíaselo a quien gestione la web.

My web game at https://wafflegame.net/ needs to be playable inside an iframe on https://gamesdle.bid (a directory of daily games that embeds games in its page).

Right now the browser refuses to show it in a frame because the page is served with:
  Content-Security-Policy: ... frame-ancestors 'self' https://airmail.news https://*.airmail.news https://*.airmailmedia.com https://puzzlist.com https://*.puzzlist.com https://waffleclub.com https://*.waffleclub.com https://waffle.dev http://localhost:5173 ...

Please make these changes, keeping everything else about the site the same:

1. Send this on every HTML response (merge it into the existing Content-Security-Policy if there is one; keep any other origins that are already allowed):
   Content-Security-Policy: frame-ancestors 'self' https://airmail.news https://*.airmail.news https://*.airmailmedia.com https://puzzlist.com https://*.puzzlist.com https://waffleclub.com https://*.waffleclub.com https://waffle.dev http://localhost:5173 https://gamesdle.bid
2. Remove the X-Frame-Options header. It cannot allow one specific outside site, and frame-ancestors replaces it in all current browsers.
3. Find where headers are set. Common places: public/_headers (Cloudflare Pages, Netlify), vercel.json "headers", next.config.js headers(), nuxt/vite server config, nginx add_header, Apache Header set, Express/helmet (frameguard and contentSecurityPolicy.frameAncestors), a Cloudflare Worker or other edge function, or a CDN response-header rule.
4. Search the client code for frame-busting such as `if (top !== self) top.location = ...`, `window.top.location`, or code that hides the page when `window.self !== window.top`, and remove it or allow it to run when the parent is https://gamesdle.bid.
5. Inside a cross-site iframe, browsers may block or partition third-party cookies and storage. If saving progress or signing in depends on cookies, make sure the game still starts and plays without them (localStorage is fine; it is kept separately per embedding site).

When it is deployed, verify with:
  curl -sI https://wafflegame.net/ | grep -iE 'x-frame-options|content-security-policy'
The output should include frame-ancestors with https://gamesdle.bid and no X-Frame-Options DENY or SAMEORIGIN.