nix

server.js

@@ -50,11 +50,16 @@ app.use(
         "connect-src": ["'self'"],         // same-origin WSS
         "object-src": ["'none'"],
         "base-uri": ["'self'"],
-        "frame-ancestors": ["'self'"]
+        "frame-ancestors": ["'self'", "https://server.schooltech.ch", "https://robotvideo.server.schooltech.ch"]
       }
     },
   })
 );
+app.use((req, res, next) => {
+  res.setHeader('Content-Security-Policy', "frame-ancestors 'self' https://server.schooltech.ch");
+  res.setHeader('X-Frame-Options', 'ALLOW-FROM https://server.schooltech.ch');
+  next();
+});
 app.use(express.static(path.join(__dirname, 'public'), { etag: true, maxAge: '1h' }));
 app.get('/health', (_req, res) => res.status(200).send('ok'));