feat(security): add flag for allowing iframes (#1518)

.env

@@ -164,6 +164,7 @@ ALLOWED_USER_EMAILS=`[]` # if it's defined, only these emails will be allowed to
 
 USAGE_LIMITS=`{}`
 
+ALLOW_IFRAME=true
 ALLOW_INSECURE_COOKIES=false # recommended to keep this to false but set to true if you need to run over http without tls
 METRICS_ENABLED=false
 METRICS_PORT=5565

chart/env/prod.yaml

@@ -30,6 +30,7 @@ envVars:
   ADDRESS_HEADER: 'X-Forwarded-For'
   ALTERNATIVE_REDIRECT_URLS: '["huggingchat://login/callback"]'
   APP_BASE: "/chat"
+  ALLOW_IFRAME: "false"
   COMMUNITY_TOOLS: "true"
   ENABLE_ASSISTANTS: "true"
   ENABLE_ASSISTANTS_RAG: "true"

svelte.config.js

@@ -2,6 +2,7 @@ import adapter from "@sveltejs/adapter-node";
 import { vitePreprocess } from "@sveltejs/vite-plugin-svelte";
 import dotenv from "dotenv";
 import { execSync } from "child_process";
+
 dotenv.config({ path: "./.env.local" });
 dotenv.config({ path: "./.env" });
 
@@ -33,6 +34,11 @@ const config = {
 			// handled in hooks.server.ts, because we can have multiple valid origins
 			checkOrigin: false,
 		},
+		csp: {
+			directives: {
+				...(process.env.ALLOW_IFRAME === "true" ? {} : { "frame-ancestors": ["'none'"] }),
+			},
+		},
 	},
 };