From b7e9fdcb51dbff8897d17280d9239e7695581a1b Mon Sep 17 00:00:00 2001
From: ila <2+ila@noreply.git.ilapage.cn>
Date: Thu, 13 Aug 2026 21:32:52 +0800
Subject: [PATCH] fix: use same-origin frame authentication (#54)

---
 Sense/server/app/sense/liveview/http.go | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Sense/server/app/sense/liveview/http.go b/Sense/server/app/sense/liveview/http.go
index 24eecec..1dca78e 100644
--- a/Sense/server/app/sense/liveview/http.go
+++ b/Sense/server/app/sense/liveview/http.go
@@ -14,7 +14,7 @@ func (m *Module) Register(app *platform.App) {
 	app.Handle("GET /api/v1/liveview/routes", identity.Require(identity.PermissionMediaRead, http.HandlerFunc(m.routes)))
 	app.Handle("POST /api/v1/liveview/sessions", identity.Require(identity.PermissionMediaRead, http.HandlerFunc(m.create)))
 	app.Handle("GET /api/v1/liveview/sessions/{id}", identity.Require(identity.PermissionMediaRead, http.HandlerFunc(m.get)))
-	app.Handle("GET /api/v1/liveview/sessions/{id}/player", identity.Require(identity.PermissionMediaRead, http.HandlerFunc(m.player)))
+	app.Handle("GET /api/v1/liveview/sessions/{id}/player", identity.RequireSameOriginFrame(identity.PermissionMediaRead, http.HandlerFunc(m.player)))
 }
 func (m *Module) routes(w http.ResponseWriter, r *http.Request) {
 	items, err := m.service.Routes(r.Context())