From 1c7b782b7fd64be586beaa830809e656c37fb225 Mon Sep 17 00:00:00 2001 From: Pulse Monitor Date: Sun, 24 Aug 2025 19:00:13 +0000 Subject: [PATCH] fix: apply security headers middleware to enable iframe embedding The SecurityHeaders middleware was not being applied to the router, causing the "Allow iframe embedding" setting to not take effect. This fix properly applies the middleware with the saved settings, allowing iframe embedding to work when enabled. addresses #351 --- internal/api/router.go | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-) diff --git a/internal/api/router.go b/internal/api/router.go index 635e6e367..73221cb1d 100644 --- a/internal/api/router.go +++ b/internal/api/router.go @@ -53,9 +53,18 @@ func NewRouter(cfg *config.Config, monitor *monitoring.Monitor, wsHub *websocket // Start forwarding update progress to WebSocket go r.forwardUpdateProgress() - // Wrap with error handler middleware only + // Load system settings to configure security headers + allowEmbedding := false + allowedOrigins := "" + if systemSettings, err := r.persistence.LoadSystemSettings(); err == nil && systemSettings != nil { + allowEmbedding = systemSettings.AllowEmbedding + allowedOrigins = systemSettings.AllowedEmbedOrigins + } + + // Apply security headers with embedding configuration + // Then wrap with error handler middleware // Note: TimeoutHandler breaks WebSocket upgrades - return ErrorHandler(r) + return ErrorHandler(SecurityHeadersWithConfig(r, allowEmbedding, allowedOrigins)) } // handleDiscovery returns cached discovery results