Internal
Public Access
Keith SmithandClaude Sonnet 4.5
c686021f96
The CSP_FRAME_ANCESTORS = ("'none'",) setting in production.py was
blocking iframe embedding even after removing X-Frame-Options.
Updated middleware to:
- Detect Android WebView via 'wv' in User-Agent (more reliable)
- Remove both X-Frame-Options AND Content-Security-Policy headers
- This allows mobile app iframe embedding while keeping browser protection
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
53 lines
2.0 KiB
Python
53 lines
2.0 KiB
Python
"""
|
|
Middleware to allow iframe embedding for the KeepItGoing mobile app.
|
|
|
|
The mobile app uses Capacitor WebView which embeds the website in an iframe.
|
|
This middleware detects requests from the mobile app and removes both
|
|
X-Frame-Options and Content-Security-Policy frame-ancestors headers to allow
|
|
iframe embedding, while keeping clickjacking protection for regular web browsers.
|
|
"""
|
|
|
|
|
|
class AllowMobileAppFramingMiddleware:
|
|
"""
|
|
Remove frame-blocking headers for requests from KeepItGoing mobile app.
|
|
|
|
The mobile app uses a Capacitor WebView. We detect these requests via
|
|
User-Agent and remove X-Frame-Options and CSP frame-ancestors headers.
|
|
"""
|
|
|
|
def __init__(self, get_response):
|
|
self.get_response = get_response
|
|
|
|
def __call__(self, request):
|
|
response = self.get_response(request)
|
|
|
|
# Check if request is from KeepItGoing mobile app
|
|
user_agent = request.META.get('HTTP_USER_AGENT', '')
|
|
|
|
# Detect Capacitor/Android WebView patterns
|
|
# Note: We're being permissive here to catch all mobile app requests
|
|
is_mobile_app = (
|
|
'wv' in user_agent.lower() or # Android WebView
|
|
'CapacitorHttp' in user_agent or
|
|
'com.firebugit.keepitgoing' in user_agent or
|
|
('KeepItGoing' in user_agent and 'Mobile' in user_agent)
|
|
)
|
|
|
|
# Remove frame-blocking headers for mobile app requests
|
|
if is_mobile_app:
|
|
# Remove X-Frame-Options
|
|
if 'X-Frame-Options' in response:
|
|
del response['X-Frame-Options']
|
|
|
|
# Remove or modify Content-Security-Policy
|
|
if 'Content-Security-Policy' in response:
|
|
csp = response['Content-Security-Policy']
|
|
# Remove frame-ancestors directive
|
|
if 'frame-ancestors' in csp:
|
|
# Remove the entire CSP header for simplicity
|
|
# In production, you'd want to parse and modify it properly
|
|
del response['Content-Security-Policy']
|
|
|
|
return response
|