From 8fb92a4e2a8924a54680ece396b894fbf50cdffa Mon Sep 17 00:00:00 2001
From: Schalli <kschaller@ctl.de>
Date: Tue, 7 Jul 2026 15:34:56 +0200
Subject: [PATCH] fix(favorites): route icon img through same-origin proxy, not
 hotlink

<img src={fav.iconUrl}> hotlinked the external favicon directly; sites
that send Cross-Origin-Resource-Policy: same-origin (e.g. claude.ai)
get blocked by the browser (net::ERR_BLOCKED_BY_RESPONSE.NotSameOrigin),
leaving only the letter fallback. Points src at the new same-origin
/api-proxy/favorites/:id/icon route instead (same pattern already used
for the user avatar image). Render guard and onError fallback unchanged.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
---
 apps/web/src/components/dashboard/widgets/favorites-widget.tsx | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/apps/web/src/components/dashboard/widgets/favorites-widget.tsx b/apps/web/src/components/dashboard/widgets/favorites-widget.tsx
index 801d017..e6edc89 100644
--- a/apps/web/src/components/dashboard/widgets/favorites-widget.tsx
+++ b/apps/web/src/components/dashboard/widgets/favorites-widget.tsx
@@ -360,7 +360,7 @@ function FavoriteTile({
             </span>
             {fav.iconUrl && (
               <img
-                src={fav.iconUrl}
+                src={`/api-proxy/favorites/${encodeURIComponent(fav.id)}/icon`}
                 alt=""
                 width={20}
                 height={20}