From 14d3ed81f55fdda1868315333eb5c287aa847361 Mon Sep 17 00:00:00 2001 From: dan Date: Tue, 2 Jul 2024 18:55:42 +0100 Subject: [PATCH] Allow rendering iframe from localhost and staging Have not tested but this is my guess for how to do it. --- bskyweb/cmd/bskyweb/server.go | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/bskyweb/cmd/bskyweb/server.go b/bskyweb/cmd/bskyweb/server.go index d7e41a4ca8..35481e245f 100644 --- a/bskyweb/cmd/bskyweb/server.go +++ b/bskyweb/cmd/bskyweb/server.go @@ -109,11 +109,11 @@ func serve(cctx *cli.Context) error { // SECURITY: Do not modify without due consideration. e.Use(middleware.SecureWithConfig(middleware.SecureConfig{ - ContentTypeNosniff: "nosniff", - XFrameOptions: "SAMEORIGIN", - HSTSMaxAge: 31536000, // 365 days + ContentTypeNosniff: "nosniff", + XFrameOptions: "SAMEORIGIN", + ContentSecurityPolicy: "frame-ancestors 'self' http://localhost:19006 https://*.bsky.dev", + HSTSMaxAge: 31536000, // 365 days // TODO: - // ContentSecurityPolicy // XSSProtection })) e.Use(middleware.LoggerWithConfig(middleware.LoggerConfig{