Upgraded security headers to CSP to allow custom domain framing

webpass/__init__.py

@@ -105,11 +105,19 @@ def create_app():
                 if not session.get('bio_verified'):
                     return redirect(url_for('bio.lock_screen'))
 
+    # 5. SECURITY HEADERS
     # 5. SECURITY HEADERS
     @app.after_request
     def add_security_headers(response):
         response.headers['Strict-Transport-Security'] = 'max-age=31536000; includeSubDomains'
-        response.headers['X-Frame-Options'] = 'SAMEORIGIN'
+        
+        # The modern, precise way to whitelist specific domains for iframing
+        # 'self' allows your own app, the URLs allow your specific domains
+        response.headers['Content-Security-Policy'] = "frame-ancestors 'self' https://webpass.augsec.in https://huggingface.co;"
+        
+        # Note: We remove X-Frame-Options because CSP frame-ancestors replaces it 
+        # and is fully supported by all modern browsers.
+        
         return response
 
     from webpass.models import BiometricDevice