Add referrerPolicy to image loading through asset manager

As already replied to the PR, this can be done by extending the image component if necessary, without the risk of breaking the integration for others.

And as a note, when you want to add a feature, you should always think about how this will work for others. So, if the referrerPolicy thing offers more options, it probably makes sense to make it customizable, so the new feature can be adaptable also for other cases (you can't force it to origin only because it works for your case).

Thank you very much for the tipp @artf - I'll try to get this done by extending the original component. Have a great day! 😃

For everyone who has the same problem that the iframe doesn't send referrer headers for content displayed inside of it, here's a quick and dirty fix.

Just set the Canvas iFrame src to your desired domain that you want to use the referrer with. In my case I wanted to have the same domain like for the webpage the editor is displayed on. While rendering, the srcDoc attribute leads the way, followed by the src attribute.

Keep in mind that setting this after the Canvas iFrame is loaded may lead to errors, so try manipulating your Canvas View attributes (not directly possible as far as I know).

Thanks for reporting this, @tomhatzer.

The issue with FEAT: Add referrerPolicy to image loading through asset manager appears to be a race condition or state management timing problem. This typically happens when component lifecycle events and DOM modifications overlap, creating an inconsistent state.

What to try:

1. Add a setTimeout wrapper to ensure the DOM has settled:

setTimeout(() => {
  // your operation here
}, 0);

2. Check initialization order — make sure components are fully loaded before you interact with them

3. Use the editor's event system — listen to completion events:

editor.on('component:mount', (component) => {
  // safe to interact with component here
});

Recommended next steps:

• Test with the latest GrapesJS version if you haven't
• Provide a minimal reproducible example (CodeSandbox) — this helps the team identify the root cause faster
• Include GrapesJS version, browser, and console errors in your report