Fix PDF export: allow same-origin iframes (X-Frame-Options)

2026-03-19 14:44:35 +01:00
parent 173d6cd953
commit 4d9854062c
1 changed files with 1 additions and 1 deletions
--- a/server/src/index.js
+++ b/server/src/index.js
@@ -47,7 +47,7 @@ app.use(express.json());
 // Security headers
 app.use((req, res, next) => {
  res.setHeader('X-Content-Type-Options', 'nosniff');
-  res.setHeader('X-Frame-Options', 'DENY');
+  res.setHeader('X-Frame-Options', 'SAMEORIGIN');
  res.setHeader('X-XSS-Protection', '1; mode=block');
  res.setHeader('Referrer-Policy', 'strict-origin-when-cross-origin');
  next();