From 50f209e84aa62ba82d0bd1498ecac89a29105feb Mon Sep 17 00:00:00 2001
From: qing <1776177662@qq.com>
Date: Tue, 28 Jul 2026 11:53:35 +0800
Subject: [PATCH] =?UTF-8?q?fix:=20X-Frame-Options/frame-ancestors=20?=
 =?UTF-8?q?=E6=94=B9=E4=B8=BA=E5=90=8C=E6=BA=90=E4=BB=A5=E4=BF=AE=E5=A4=8D?=
 =?UTF-8?q?=E6=9D=A1=E4=BE=8B=E5=BC=B9=E7=AA=97=E7=A9=BA=E7=99=BD?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 ai_review/security_middleware.py | 4 ++--
 db/security_middleware.py        | 4 ++--
 dnfs/security_middleware.py      | 4 ++--
 static/security_middleware.py    | 6 +++---
 waf/internal/proxy/proxy.go      | 5 +++--
 5 files changed, 12 insertions(+), 11 deletions(-)

diff --git a/ai_review/security_middleware.py b/ai_review/security_middleware.py
index 1cde8c4..be880f6 100644
--- a/ai_review/security_middleware.py
+++ b/ai_review/security_middleware.py
@@ -12,7 +12,7 @@ def apply_security_headers(app, csp_policy=None):
     @app.after_request
     def set_security_headers(response):
         # Prevent clickjacking
-        response.headers['X-Frame-Options'] = 'DENY'
+        response.headers['X-Frame-Options'] = 'SAMEORIGIN'
         # XSS protection (legacy browsers)
         response.headers['X-XSS-Protection'] = '1; mode=block'
         # Prevent MIME type sniffing
@@ -33,7 +33,7 @@ def apply_security_headers(app, csp_policy=None):
                 "img-src 'self' data: blob:; "
                 "font-src 'self'; "
                 "connect-src 'self'; "
-                "frame-ancestors 'none'"
+                "frame-ancestors 'self'"
             )
 
         # Remove server header info
diff --git a/db/security_middleware.py b/db/security_middleware.py
index 7e5ee15..8f69800 100644
--- a/db/security_middleware.py
+++ b/db/security_middleware.py
@@ -12,7 +12,7 @@ def apply_security_headers(app, csp_policy=None):
     @app.after_request
     def set_security_headers(response):
         # Prevent clickjacking
-        response.headers['X-Frame-Options'] = 'DENY'
+        response.headers['X-Frame-Options'] = 'SAMEORIGIN'
         # XSS protection (legacy browsers)
         response.headers['X-XSS-Protection'] = '1; mode=block'
         # Prevent MIME type sniffing
@@ -33,7 +33,7 @@ def apply_security_headers(app, csp_policy=None):
                 "img-src 'self' data: blob:; "
                 "font-src 'self'; "
                 "connect-src 'self'; "
-                "frame-ancestors 'none'"
+                "frame-ancestors 'self'"
             )
 
         # Remove server header info
diff --git a/dnfs/security_middleware.py b/dnfs/security_middleware.py
index 1cde8c4..be880f6 100644
--- a/dnfs/security_middleware.py
+++ b/dnfs/security_middleware.py
@@ -12,7 +12,7 @@ def apply_security_headers(app, csp_policy=None):
     @app.after_request
     def set_security_headers(response):
         # Prevent clickjacking
-        response.headers['X-Frame-Options'] = 'DENY'
+        response.headers['X-Frame-Options'] = 'SAMEORIGIN'
         # XSS protection (legacy browsers)
         response.headers['X-XSS-Protection'] = '1; mode=block'
         # Prevent MIME type sniffing
@@ -33,7 +33,7 @@ def apply_security_headers(app, csp_policy=None):
                 "img-src 'self' data: blob:; "
                 "font-src 'self'; "
                 "connect-src 'self'; "
-                "frame-ancestors 'none'"
+                "frame-ancestors 'self'"
             )
 
         # Remove server header info
diff --git a/static/security_middleware.py b/static/security_middleware.py
index 1cde8c4..f71c34a 100644
--- a/static/security_middleware.py
+++ b/static/security_middleware.py
@@ -11,8 +11,8 @@ def apply_security_headers(app, csp_policy=None):
 
     @app.after_request
     def set_security_headers(response):
-        # Prevent clickjacking
-        response.headers['X-Frame-Options'] = 'DENY'
+        # Prevent clickjacking (SAMEORIGIN: 允许本站 iframe 嵌套，如登录页条例弹窗)
+        response.headers['X-Frame-Options'] = 'SAMEORIGIN'
         # XSS protection (legacy browsers)
         response.headers['X-XSS-Protection'] = '1; mode=block'
         # Prevent MIME type sniffing
@@ -33,7 +33,7 @@ def apply_security_headers(app, csp_policy=None):
                 "img-src 'self' data: blob:; "
                 "font-src 'self'; "
                 "connect-src 'self'; "
-                "frame-ancestors 'none'"
+                "frame-ancestors 'self'"
             )
 
         # Remove server header info
diff --git a/waf/internal/proxy/proxy.go b/waf/internal/proxy/proxy.go
index 424b4d7..bacd0a4 100644
--- a/waf/internal/proxy/proxy.go
+++ b/waf/internal/proxy/proxy.go
@@ -64,7 +64,8 @@ func New(upstream string, waf *engine.Engine) (*Proxy, error) {
 // CSP 暂保留 unsafe-inline：forgot.html 与 games/*.html 含内联脚本。
 // HSTS 半年期、不含子域，站点全量 HTTPS 后可按需收紧。
 func setSecurityHeaders(h http.Header) {
-	h.Set("X-Frame-Options", "DENY")
+	// SAMEORIGIN：允许本站 iframe 嵌套（登录页条例弹窗），仍防跨站点击劫持
+	h.Set("X-Frame-Options", "SAMEORIGIN")
 	h.Set("X-Content-Type-Options", "nosniff")
 	h.Set("X-XSS-Protection", "1; mode=block")
 	h.Set("Referrer-Policy", "strict-origin-when-cross-origin")
@@ -72,7 +73,7 @@ func setSecurityHeaders(h http.Header) {
 	h.Set("Strict-Transport-Security", "max-age=15552000")
 	h.Set("Content-Security-Policy",
 		"default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; "+
-			"img-src 'self' data: blob:; font-src 'self'; connect-src 'self'; frame-ancestors 'none'")
+			"img-src 'self' data: blob:; font-src 'self'; connect-src 'self'; frame-ancestors 'self'")
 }
 
 // ServeHTTP 实现 http.Handler。