Merge pull request #51 from AOT-Technologies/bugfix/single-domain-emb…

…ed-issue [Bugfix] removed frame-ancestors from CSP policy to be handled from nginx later
AOT-Technologies · Dec 19, 2024 · a81fe44 · a81fe44
2 parents 7c3a13b + 66e2ad8
commit a81fe44
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/redash/settings/__init__.py b/redash/settings/__init__.py
@@ -117,7 +117,7 @@
 # for more information. E.g.:
 CONTENT_SECURITY_POLICY = os.environ.get(
     "REDASH_CONTENT_SECURITY_POLICY",
-    "default-src 'self'; style-src 'self' 'unsafe-inline'; script-src 'self' 'unsafe-eval'; font-src 'self' data:; img-src 'self' http: https: data: blob:; object-src 'none'; frame-ancestors 'none'; frame-src redash.io;",
+    "default-src 'self'; style-src 'self' 'unsafe-inline'; script-src 'self' 'unsafe-eval'; font-src 'self' data:; img-src 'self' http: https: data: blob:; object-src 'none'; frame-src redash.io;",
 )
 CONTENT_SECURITY_POLICY_REPORT_URI = os.environ.get("REDASH_CONTENT_SECURITY_POLICY_REPORT_URI", "")
 CONTENT_SECURITY_POLICY_REPORT_ONLY = parse_boolean(