fix: allow same-origin liveview player embedding (#54)

2026-08-13 15:26:05 +08:00
parent ffacf7a682
commit aed36eab99
1 changed files with 6 additions and 1 deletions
@@ -61,6 +61,11 @@ func (m *Module) player(w http.ResponseWriter, r *http.Request) {
 	}
 	w.Header().Set("Content-Type", "text/html; charset=utf-8")
 	w.Header().Set("Cache-Control", "no-store")
-	w.Header().Set("Content-Security-Policy", "default-src 'none'; frame-src http: https:; style-src 'unsafe-inline'")
+	// This endpoint is the authenticated, same-origin wrapper loaded by the
+	// live-view page. Keep the global DENY policy everywhere else, and allow
+	// only Sense itself to embed this wrapper.
+	w.Header().Set("X-Frame-Options", "SAMEORIGIN")
+	w.Header().Set("Content-Security-Policy", "default-src 'none'; frame-ancestors 'self'; frame-src http: https:; style-src 'unsafe-inline'")
 	_ = playerTemplate.Execute(w, target)
 }
+