From 6240030dd57e5743ac6f0593085333c1e4f2515f Mon Sep 17 00:00:00 2001
From: LD-Reborn <lucretia.dietz@gmx.de>
Date: Sat, 18 Jul 2026 19:39:53 +0200
Subject: [PATCH] fix(server): adds XFrameOptions and ContentSecurityPolicy
 headers

---
 src/ReverseLlama.Server/Program.cs | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/src/ReverseLlama.Server/Program.cs b/src/ReverseLlama.Server/Program.cs
index 08d806f..98dbd6f 100644
--- a/src/ReverseLlama.Server/Program.cs
+++ b/src/ReverseLlama.Server/Program.cs
@@ -92,6 +92,8 @@ app.Use(async (context, next) =>
     context.Response.Headers.AccessControlAllowOrigin = "*";
     context.Response.Headers.AccessControlAllowMethods = "GET, POST, PUT, DELETE, PATCH, OPTIONS";
     context.Response.Headers.AccessControlAllowHeaders = "Content-Type, Authorization";
+    context.Response.Headers.XFrameOptions = "DENY";
+    context.Response.Headers.ContentSecurityPolicy = "frame-ancestors 'none'";
 
     if (HttpMethods.IsOptions(context.Request.Method))
     {