From daadeaa1b0de07b203335fddea3df40bda251683 Mon Sep 17 00:00:00 2001
From: Arlen Johnson <arlen@sphericalcowgroup.com>
Date: Thu, 2 Jul 2026 11:44:25 -0400
Subject: [PATCH] Ensure that COEP does not block Debug Kit toolbar in debug
 mode (nojira)

---
 app/templates/element/httpHeaders.php | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/app/templates/element/httpHeaders.php b/app/templates/element/httpHeaders.php
index 20f8b4a96..5309bb57d 100644
--- a/app/templates/element/httpHeaders.php
+++ b/app/templates/element/httpHeaders.php
@@ -74,7 +74,10 @@
   header("Permissions-Policy: $permissionsPolicy");
   header("X-Content-Type-Options: nosniff");
   header("Cross-Origin-Opener-Policy: same-origin");
-  header("Cross-Origin-Embedder-Policy: require-corp");
+  if (!Cake\Core\Configure::read('debug')) {
+    // This COEP will block the Debug Kit iframe, so skip it when in debug mode. 
+    header("Cross-Origin-Embedder-Policy: require-corp");
+  }
   header("X-Permitted-Cross-Domain-Policies: none");
   header("Referrer-Policy: strict-origin-when-cross-origin");