public_git/bambuddy
1
0
Fork 0
mirror of https://github.com/maziggy/bambuddy.git synced 2026-10-17 11:25:48 +02:00
Code Issues Packages Projects Releases Wiki Activity

fix(auth): let the connected-app consent page load inside Bambuddy's own frames

Browse Source 
An app opened from the sidebar signs in inside Bambuddy's iframe, but every
page sent frame-ancestors 'none', so the browser refused to show
/connect/authorize there. That path now gets 'self', like the streaming
overlay: every ancestor must be Bambuddy itself, so foreign pages still
cannot frame it.
This commit is contained in:
maziggy
2026-09-26 13:37:02 +02:00
parent d56b48c499
commit 4e83751f71
3 changed files with 38 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/tests/integration/test_security_headers.py
+28 -1
View File
@@ -135,6 +135,24 @@ async def test_overlay_route_allows_same_origin_framing(async_client: AsyncClien
assert resp.headers.get("X-Frame-Options") == "SAMEORIGIN"
@pytest.mark.asyncio
@pytest.mark.integration
async def test_connect_authorize_allows_same_origin_framing(async_client: AsyncClient, monkeypatch):
"""A connected app opened from the sidebar signs in inside Bambuddy's iframe.
Its "Sign in with Bambuddy" navigates that iframe to /connect/authorize;
with 'none' the browser refused to render the consent page there. 'self'
still refuses any foreign framer.
"""
from backend.app import main as main_module
monkeypatch.setattr(main_module, "_TRUSTED_FRAME_ORIGINS", ())
resp = await async_client.get("/connect/authorize?client_id=x")
assert "frame-ancestors 'self';" in resp.headers.get("Content-Security-Policy", "")
assert resp.headers.get("X-Frame-Options") == "SAMEORIGIN"
@pytest.mark.asyncio
@pytest.mark.integration
async def test_other_spa_routes_still_refuse_all_framing(async_client: AsyncClient, monkeypatch):
@@ -144,7 +162,16 @@ async def test_other_spa_routes_still_refuse_all_framing(async_client: AsyncClie
monkeypatch.setattr(main_module, "_TRUSTED_FRAME_ORIGINS", ())
for path in ("/", "/settings", "/printers", "/overlays", "/camwall"):
for path in (
"/",
"/settings",
"/printers",
"/overlays",
"/camwall",
"/connect",
"/connect/authorize/x",
"/connect/other",
):
resp = await async_client.get(path)
csp = resp.headers.get("Content-Security-Policy", "")
assert "frame-ancestors 'none'" in csp, f"{path} must not be framable"