block framing of the dashboard and require inbox UUIDs for widget joins

cmd/handlers.go

@@ -465,6 +465,9 @@ func serveIndexPage(r *fastglue.Request) error {
 	r.RequestCtx.Response.Header.Add("Pragma", "no-cache")
 	r.RequestCtx.Response.Header.Add("Expires", "-1")
 
+	r.RequestCtx.Response.Header.Set("Content-Security-Policy", "frame-ancestors 'self'")
+	r.RequestCtx.Response.Header.Set("X-Frame-Options", "SAMEORIGIN")
+
 	// Serve the index.html file from the embedded filesystem.
 	file, err := app.fs.Get(path.Join(frontendDir, "index.html"))
 	if err != nil {

cmd/widget_ws.go

@@ -13,6 +13,7 @@ import (
 	"github.com/abhinavxd/libredesk/internal/httputil"
 	"github.com/abhinavxd/libredesk/internal/inbox/channel/livechat"
 	"github.com/fasthttp/websocket"
+	"github.com/google/uuid"
 	"github.com/zerodha/fastglue"
 )
 
@@ -220,6 +221,11 @@ func handleInboxJoin(app *App, sc *safeConn, data json.RawMessage, token, client
 		return nil, nil, "", 0, fmt.Errorf("invalid join data: %w", err)
 	}
 
+	// Numeric inbox IDs are guessable, widgets always join by inbox UUID.
+	if _, err := uuid.Parse(joinData.InboxID); err != nil {
+		return nil, nil, "", 0, fmt.Errorf("inbox not found")
+	}
+
 	inbox, err := app.inbox.GetDBRecord(joinData.InboxID)
 	if err != nil {
 		return nil, nil, "", 0, fmt.Errorf("inbox not found: %w", err)