From da85fc8db38f803b2532517ff5b8f37c68e1f304 Mon Sep 17 00:00:00 2001 From: Pi Agent Date: Tue, 4 Aug 2026 18:53:51 +0200 Subject: [PATCH] Allow iframe embedding: X-Frame-Options SAMEORIGIN, frame-ancestors 'self' + localhost Co-authored-by: Orca --- api/helpers.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/api/helpers.py b/api/helpers.py index d285cfe4..dab01e19 100644 --- a/api/helpers.py +++ b/api/helpers.py @@ -74,7 +74,7 @@ _CSP_HEADER_NAME = 'Content-Security-Policy' _CSP_SHARED_POLICY_TEMPLATE = ( "default-src 'self' https://*.cloudflareaccess.com; " "object-src 'none'; " - "frame-ancestors 'none'; " + "frame-ancestors 'self' http://localhost:* http://127.0.0.1:* https://localhost:* https://127.0.0.1:*; " "script-src 'self' 'unsafe-inline' https://cdn.jsdelivr.net https://static.cloudflareinsights.com blob:; " "worker-src blob: 'self' https://cdn.jsdelivr.net; " "style-src 'self' 'unsafe-inline' https://cdn.jsdelivr.net https://fonts.googleapis.com; " @@ -181,7 +181,7 @@ def _security_headers(handler): handler._csp_extra_connect_src = extra_connect_src handler._csp_extra_frame_src = extra_frame_src handler.send_header('X-Content-Type-Options', 'nosniff') - handler.send_header('X-Frame-Options', 'DENY') + handler.send_header('X-Frame-Options', 'SAMEORIGIN') handler.send_header('Referrer-Policy', 'same-origin') handler.send_header(_CSP_HEADER_NAME, _build_csp_enforced_policy(extra_connect_src, extra_frame_src)) handler.send_header(