From aed36eab99216c459166b73682838c1bafebf926 Mon Sep 17 00:00:00 2001
From: ila <2+ila@noreply.git.ilapage.cn>
Date: Thu, 13 Aug 2026 15:26:05 +0800
Subject: [PATCH] fix: allow same-origin liveview player embedding (#54)

---
 Sense/server/app/sense/liveview/http.go | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/Sense/server/app/sense/liveview/http.go b/Sense/server/app/sense/liveview/http.go
index 1e0c444..24eecec 100644
--- a/Sense/server/app/sense/liveview/http.go
+++ b/Sense/server/app/sense/liveview/http.go
@@ -61,6 +61,11 @@ func (m *Module) player(w http.ResponseWriter, r *http.Request) {
 	}
 	w.Header().Set("Content-Type", "text/html; charset=utf-8")
 	w.Header().Set("Cache-Control", "no-store")
-	w.Header().Set("Content-Security-Policy", "default-src 'none'; frame-src http: https:; style-src 'unsafe-inline'")
+	// This endpoint is the authenticated, same-origin wrapper loaded by the
+	// live-view page. Keep the global DENY policy everywhere else, and allow
+	// only Sense itself to embed this wrapper.
+	w.Header().Set("X-Frame-Options", "SAMEORIGIN")
+	w.Header().Set("Content-Security-Policy", "default-src 'none'; frame-ancestors 'self'; frame-src http: https:; style-src 'unsafe-inline'")
 	_ = playerTemplate.Execute(w, target)
 }
+