Allow self for iframes

2026-01-06 12:19:37 -06:00 · 2022-06-27 10:18:46 +02:00
parent 8d1f70ac09
commit a5c2fdebd4
2 changed files with 7 additions and 0 deletions
--- a/services/web/pkg/middleware/silentrefresh.go
+++ b/services/web/pkg/middleware/silentrefresh.go
@@ -8,6 +8,7 @@ import (
 func SilentRefresh(next http.Handler) http.Handler {
 	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		w.Header().Set("X-Frame-Options", "SAMEORIGIN")
+		w.Header().Set("Content-Security-Policy", "frame-ancestors 'self'")
 		next.ServeHTTP(w, r)
 	})
 }