selective route permission to use embeds with x-frame-deny

1 files changed, 8 insertions, 0 deletions

diff --git a/server.ts b/server.ts
index a6052faed..26750802c 100644
--- a/server.ts
+++ b/server.ts
@@ -15,6 +15,7 @@ import * as express from 'express'
 import * as morgan from 'morgan'
 import * as cors from 'cors'
 import * as cookieParser from 'cookie-parser'
+import * as helmet from 'helmet'
 
 process.title = 'peertube'
 
@@ -48,6 +49,13 @@ if (errorMessage !== null) {
 // Trust our proxy (IP forwarding...)
 app.set('trust proxy', CONFIG.TRUST_PROXY)
 
+// Security middlewares
+app.use(helmet({
+  frameguard: {
+    action: 'deny'
+  }
+}))
+
 // ----------- Database -----------
 
 // Initialize database and models