我在使用 Ant Design Pro 和 FeathersJS 开发一个支持企业微信二维码登录的应用。这个功能之前很顺利地完成过，而这次总是无法加载出二维码。
经过排查是 FeathersJS 使用的 helmet 库升级了安全策略，默认禁用了站外资源。
要顺利加载企业微信的二维码，需要调整降低安全策略。
app.use(helmet({
contentSecurityPolicy: false,
+ crossOriginEmbedderPolicy: false, // 允许 iframe
+ crossOriginResourcePolicy: false, // 允许 站外资源
}))
References
Content Security Policy
The HTTP Content-Security-Policy response header allows web site administrators to control resources the user agent is allowed to load for a given page. With a few exceptions, policies mostly involve specifying server origins and script endpoints. This helps guard against cross-site scripting attacks (Cross-site_scripting).
Cross-Origin-Embedder-Policy
The HTTP Cross-Origin-Embedder-Policy (COEP) response header prevents a document from loading any cross-origin resources that don't explicitly grant the document permission (using CORP or CORS).
Cross-Origin-Resource-Policy
The HTTP Cross-Origin-Resource-Policy response header conveys a desire that the browser blocks no-cors cross-origin/cross-site requests to the given resource.
