From 67fdacd9135a47b3e0c796936870ece6310065bb Mon Sep 17 00:00:00 2001 From: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> Date: Fri, 27 Mar 2026 21:12:42 +0000 Subject: [PATCH] feat: add frame-ancestors CSP header and remove X-Frame-Options: DENY - Added frame-ancestors directive with 'self', http://localhost:3000, and https://venice-internal-flax.vercel.app to Content-Security-Policy header - Removed X-Frame-Options: DENY header to allow iframe embedding Co-Authored-By: bot_apk --- server.js | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/server.js b/server.js index bae08b9..6279052 100644 --- a/server.js +++ b/server.js @@ -29,10 +29,10 @@ app.use((req, res, next) => { "style-src 'self'; " + "connect-src 'self' https://cdn.jsdelivr.net https://storage.googleapis.com; " + "worker-src 'self' blob:; " + - "img-src 'self' data: blob:" + "img-src 'self' data: blob:; " + + "frame-ancestors 'self' http://localhost:3000 https://venice-internal-flax.vercel.app" ); res.setHeader('X-Content-Type-Options', 'nosniff'); - res.setHeader('X-Frame-Options', 'DENY'); res.setHeader('Referrer-Policy', 'strict-origin-when-cross-origin'); next(); });