dev day #65

internal/middleware/security_headers.go

@@ -11,8 +11,8 @@ func SecurityHeaders() gin.HandlerFunc {
 		// Prevent MIME type sniffing
 		c.Header("X-Content-Type-Options", "nosniff")
 
-		// Prevent clickjacking
-		c.Header("X-Frame-Options", "DENY")
+		// Prevent clickjacking (allow same-origin for PDF previews)
+		c.Header("X-Frame-Options", "SAMEORIGIN")
 
 		// Referrer policy
 		c.Header("Referrer-Policy", "strict-origin-when-cross-origin")
@@ -56,7 +56,7 @@ func buildCSP(production bool) string {
 			"object-src 'none'; " +
 			"base-uri 'self'; " +
 			"form-action 'self'; " +
-			"frame-ancestors 'none'; " +
+			"frame-ancestors 'self'; " +
 			"upgrade-insecure-requests;"
 	}
 
@@ -71,5 +71,5 @@ func buildCSP(production bool) string {
 		"object-src 'none'; " +
 		"base-uri 'self'; " +
 		"form-action 'self'; " +
-		"frame-ancestors 'none';"
+		"frame-ancestors 'self';"
 }