Internal
Public Access
Keith SmithandClaude Sonnet 4.5
31a0c3c8c5
Created Django middleware that detects requests from the KeepItGoing mobile app (via User-Agent) and removes X-Frame-Options header to allow iframe embedding. Changes: - Created tasks/middleware/mobile_app.py with AllowMobileAppFramingMiddleware - Added middleware to settings after XFrameOptionsMiddleware - Detects Capacitor WebView User-Agent patterns - Removes X-Frame-Options only for mobile app, keeps protection for browsers This allows the mobile app to embed the website in an iframe while maintaining clickjacking protection for regular web browsers. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
40 lines
1.3 KiB
Python
40 lines
1.3 KiB
Python
"""
|
|
Middleware to allow iframe embedding for the KeepItGoing mobile app.
|
|
|
|
The mobile app uses Capacitor WebView which embeds the website in an iframe.
|
|
This middleware detects requests from the mobile app and removes X-Frame-Options
|
|
header to allow iframe embedding, while keeping clickjacking protection for
|
|
regular web browsers.
|
|
"""
|
|
|
|
|
|
class AllowMobileAppFramingMiddleware:
|
|
"""
|
|
Remove X-Frame-Options header for requests from KeepItGoing mobile app.
|
|
|
|
The mobile app uses a Capacitor WebView with a specific User-Agent pattern.
|
|
We detect these requests and allow iframe embedding for them.
|
|
"""
|
|
|
|
def __init__(self, get_response):
|
|
self.get_response = get_response
|
|
|
|
def __call__(self, request):
|
|
response = self.get_response(request)
|
|
|
|
# Check if request is from KeepItGoing mobile app
|
|
user_agent = request.META.get('HTTP_USER_AGENT', '')
|
|
|
|
# Capacitor apps include "CapacitorHttp" or the app package name in User-Agent
|
|
is_mobile_app = (
|
|
'CapacitorHttp' in user_agent or
|
|
'com.firebugit.keepitgoing' in user_agent or
|
|
'KeepItGoing' in user_agent and 'Mobile' in user_agent
|
|
)
|
|
|
|
# Remove X-Frame-Options for mobile app requests
|
|
if is_mobile_app and 'X-Frame-Options' in response:
|
|
del response['X-Frame-Options']
|
|
|
|
return response
|