Add security headers to disallow iframe embedding (#11632)

* fix: add security headers to devServer configuration

* fix: update nginx configuration to enhance security headers

docker/nginx.conf

@@ -12,6 +12,9 @@ http {
     include       /etc/nginx/mime.types;
     default_type  application/octet-stream;
 
+    add_header X-Frame-Options "DENY" always;
+    add_header Content-Security-Policy "frame-ancestors 'none'" always;
+
     log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
                       '$status $body_bytes_sent "$http_referer" '
                       '"$http_user_agent" "$http_x_forwarded_for"';

packages/apps/webpack.serve.cjs

@@ -11,6 +11,10 @@ module.exports = merge(
   baseConfig(__dirname, 'development'),
   {
     devServer: {
+      headers: {
+        'Content-Security-Policy': "frame-ancestors 'none'",
+        'X-Frame-Options': 'DENY'
+      },
       hot: true,
       open: false,
       port: 3000,