Ship file viewer, editor improvements, and private package releases

packages/core/src/headers.ts

@@ -91,7 +91,7 @@ export interface SecurityConfig {
   trustedTypes?: false | TrustedTypesConfig;
   /** Defaults to "same-origin". */
   crossOriginOpenerPolicy?: false | "same-origin" | "same-origin-allow-popups" | "unsafe-none";
-  /** Defaults to "DENY". */
+  /** Defaults to "SAMEORIGIN". */
   frameOptions?: false | "DENY" | "SAMEORIGIN";
   /** Defaults to "strict-origin-when-cross-origin". */
   referrerPolicy?: false | string;
@@ -116,7 +116,7 @@ const DEFAULT_CSP: Record<string, string[]> = {
   "connect-src": ["'self'", "ws:", "wss:"],
   "object-src": ["'none'"],
   "base-uri": ["'self'"],
-  "frame-ancestors": ["'none'"],
+  "frame-ancestors": ["'self'"],
   "form-action": ["'self'"],
 };
 
@@ -248,7 +248,7 @@ function applyBaseSecurityHeaders(
 ): void {
   headers.set("X-Content-Type-Options", "nosniff");
 
-  const frameOptions = security?.frameOptions ?? "DENY";
+  const frameOptions = security?.frameOptions ?? "SAMEORIGIN";
   if (frameOptions !== false) headers.set("X-Frame-Options", frameOptions);
 
   const coop = security?.crossOriginOpenerPolicy ?? "same-origin";
@@ -369,6 +369,7 @@ function serializeCsp(mode: Mode, security?: SecurityConfig, nonce?: string): st
     for (const [name, value] of Object.entries(DEFAULT_CSP)) {
       directives.set(name, [...value]);
     }
+    if (security?.frameOptions === "DENY") directives.set("frame-ancestors", ["'none'"]);
     if (mode === "development") {
       directives.set("script-src", ["'self'", "'unsafe-inline'"]);
     } else {