David/HERMES-GIELIE
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Allow iframe embedding: X-Frame-Options SAMEORIGIN, frame-ancestors 'self' + localhost

Browse source 
Co-authored-by: Orca <help@stably.ai>
This commit is contained in:
Pi Agent 2026-08-04 18:53:51 +02:00
parent 320789ae59
commit da85fc8db3
1 changed files with 2 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
api/helpers.py
View file

@ -74,7 +74,7 @@ _CSP_HEADER_NAME = 'Content-Security-Policy'
_CSP_SHARED_POLICY_TEMPLATE = (
"default-src 'self' https://*.cloudflareaccess.com; "
"object-src 'none'; "
"frame-ancestors 'none'; "
"frame-ancestors 'self' http://localhost:* http://127.0.0.1:* https://localhost:* https://127.0.0.1:*; "
"script-src 'self' 'unsafe-inline' https://cdn.jsdelivr.net https://static.cloudflareinsights.com blob:; "
"worker-src blob: 'self' https://cdn.jsdelivr.net; "
"style-src 'self' 'unsafe-inline' https://cdn.jsdelivr.net https://fonts.googleapis.com; "
@ -181,7 +181,7 @@ def _security_headers(handler):
handler._csp_extra_connect_src = extra_connect_src
handler._csp_extra_frame_src = extra_frame_src
handler.send_header('X-Content-Type-Options', 'nosniff')
handler.send_header('X-Frame-Options', 'DENY')
handler.send_header('X-Frame-Options', 'SAMEORIGIN')
handler.send_header('Referrer-Policy', 'same-origin')
handler.send_header(_CSP_HEADER_NAME, _build_csp_enforced_policy(extra_connect_src, extra_frame_src))
handler.send_header(