Fix: Change X-Frame-Options to SAMEORIGIN to allow PDF iframe embedding

2026-02-13 10:50:37 -07:00
parent fa9f4229a6
commit 0e89251bac
1 changed files with 1 additions and 1 deletions
--- a/backend/server.js
+++ b/backend/server.js
@@ -96,7 +96,7 @@ app.use((req, res, next) => {
 // Security headers
 app.use((req, res, next) => {
    res.setHeader('X-Content-Type-Options', 'nosniff');
-    res.setHeader('X-Frame-Options', 'DENY');
+    res.setHeader('X-Frame-Options', 'SAMEORIGIN');  // Allow iframes from same origin
    res.setHeader('X-XSS-Protection', '1; mode=block');
    res.setHeader('Referrer-Policy', 'strict-origin-when-cross-origin');
    res.setHeader('Permissions-Policy', 'camera=(), microphone=(), geolocation=()');