What’s The Bug?
Spotify embeds have CSP issues in both 0.51.0 and 0.52.4, but at different levels:
In 0.51.0, CSP blocked both the cover image (Spotify image CDN) and the audio/player, so the embed was completely unusable.
In 0.52.4, the cover issue is fixed (artwork loads), but audio is still blocked: the media-src directive does not allow p.scdn.co, which Spotify uses for mp3-preview URLs.
How To Reproduce It
Open Anytype Desktop 0.52.4.
Create an object → add an Embed block → choose Spotify.
In Spotify, click Share → Embed and copy the iframe code for a track or playlist.
Paste the iframe code into the Spotify embed field in Anytype and save.
Press play in the embedded player and check the iframe console.
(With the same steps in 0.51.0, there were also img-src CSP errors for image-cdn-ak.spotifycdn.com, so even the cover image did not load.)
The Expected Behavior
The native Spotify embed should be fully usable: the cover image loads and the track plays without CSP errors.
Additional Context
Device
PC
OS
Windows 10 Home
Anytype Version
0.52.4
Network Mode
AnySync
Technical Information
OS version: win32 x64 10.0.19045
App version: 0.52.4
Build number: build on 2025-12-11 18:17:31 +0000 UTC at #baeee76122f0570bb9a18fbc6c688f12d272ccb6
Library version: v0.44.0-nightly.20251212.1
Anytype Identity: A7gjMAZEREri1TmwWx3S578EWa96kPPFz1FK6iP8dM2WpeDy
Analytics ID: d05bf1b4-f2e6-4473-8a0a-22c4575b1b50
Device ID: 12D3KooWQE2jdqt3aWYmJgGs6iRUSSLi8zC43NafEupyNyqrERB4
Ethereum Address: 0xfEaeb39770d309192ac2B03309210eEf4C0b95Ce