Restore site embed framing

[tannerlinsley]

What changed

Allow the existing /partners-embed and /sponsors-embed documents to bypass the worker's global X-Frame-Options: DENY header, alongside the npm stats and Charts embed routes.

Root cause and impact

The Cloudflare worker applies X-Frame-Options: DENY to every response, then removes it only for paths recognized by isFrameEmbeddingAllowed. The two long-standing site embed routes were missing from that allowlist, so browsers refused to render the partner iframe used by the TanStack Start overview. The sponsors embed was broken by the same omission.

This restores the intended iframe behavior only for the two explicit embed documents. All regular partner, sponsor, and site pages retain the global frame denial.

Closes #1096

Validation

• pnpm test
• TypeScript and type-aware lint clean
• 143 tests passed; 1 environment-gated docs smoke test skipped
• Focused frame-embedding regression test
• Commit hook reran formatting and the full test gate successfully
• git diff --check

Risk

Low. The security-header exception is limited to two routes whose sole purpose is iframe embedding, with negative coverage for their normal page counterparts.

Summary by CodeRabbit

• New Features

  • Added support for embedding partner and sponsor pages in external frames.

• Bug Fixes

  • Updated frame-embedding validation to recognize the newly supported embed paths.

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	tanstack-com	12a093b	Commit Preview URL Branch Preview URL	Aug 03 2026, 04:09 AM

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: d0ab7d43-92e8-4d7c-a747-04c310c28799

📥 Commits

Reviewing files that changed from the base of the PR and between 898909e and 638f91e.

📒 Files selected for processing (2)

• src/utils/frame-embedding.ts
• tests/charts-catalog-frame-embedding.test.ts

---

📝 Walkthrough

Walkthrough

The frame embedding allowlist now permits /partners-embed and /sponsors-embed. Tests verify both paths and retain coverage for existing embed paths.

Changes

Frame embedding allowlist

Layer / File(s)	Summary
Allowlist and validation src/utils/frame-embedding.ts, tests/charts-catalog-frame-embedding.test.ts	isFrameEmbeddingAllowed accepts the partner and sponsor embed paths. Tests verify the new paths and existing embed cases.

Estimated code review effort: 1 (Trivial) | ~3 minutes

Possibly related PRs

• TanStack/tanstack.com#1073: Both PRs expand the paths permitted by isFrameEmbeddingAllowed and update its tests.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly describes restoring iframe framing for the embed routes changed by this pull request.
Linked Issues check	✅ Passed	The changes allow /partners-embed, satisfying issue #1096, and add regression coverage for the affected embed routes.
Out of Scope Changes check	✅ Passed	The changes are limited to frame-embedding behavior and related tests, which directly support the stated objectives.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch agent/allow-site-embeds

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}