From 0de38471db3bea3086398586b4e587b7c20347ed Mon Sep 17 00:00:00 2001
From: Arjun Porwal <65214523+ap211unitech@users.noreply.github.com>
Date: Wed, 18 Jun 2025 18:51:46 +0530
Subject: [PATCH] Add security headers to disallow iframe embedding (#11632)

* fix: add security headers to devServer configuration

* fix: update nginx configuration to enhance security headers
---
 docker/build.sh                 | 0
 docker/nginx.conf               | 3 +++
 packages/apps/webpack.serve.cjs | 4 ++++
 3 files changed, 7 insertions(+)
 mode change 100644 => 100755 docker/build.sh

diff --git a/docker/build.sh b/docker/build.sh
old mode 100644
new mode 100755
diff --git a/docker/nginx.conf b/docker/nginx.conf
index dce1ffbd61..b33c5bbfaf 100644
--- a/docker/nginx.conf
+++ b/docker/nginx.conf
@@ -12,6 +12,9 @@ http {
     include       /etc/nginx/mime.types;
     default_type  application/octet-stream;
 
+    add_header X-Frame-Options "DENY" always;
+    add_header Content-Security-Policy "frame-ancestors 'none'" always;
+
     log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
                       '$status $body_bytes_sent "$http_referer" '
                       '"$http_user_agent" "$http_x_forwarded_for"';
diff --git a/packages/apps/webpack.serve.cjs b/packages/apps/webpack.serve.cjs
index 7b960acbf2..f508d27fc9 100644
--- a/packages/apps/webpack.serve.cjs
+++ b/packages/apps/webpack.serve.cjs
@@ -11,6 +11,10 @@ module.exports = merge(
   baseConfig(__dirname, 'development'),
   {
     devServer: {
+      headers: {
+        'Content-Security-Policy': "frame-ancestors 'none'",
+        'X-Frame-Options': 'DENY'
+      },
       hot: true,
       open: false,
       port: 3000,