docker/nginx.conf

@@ -23,13 +23,15 @@ http {
         listen ${PORT};
         server_name localhost;
 
-        add_header X-Frame-Options DENY always;
+        # X-Frame-Options removed to allow Electron iframe embedding
+        # add_header X-Frame-Options DENY always;
         add_header X-Content-Type-Options nosniff always;
         add_header X-XSS-Protection "1; mode=block" always;
 
         location / {
             root /usr/share/nginx/html;
             index index.html index.htm;
+            try_files $uri $uri/ /index.html;
         }
 
         location ~* \.map$ {

electron/main.cjs

@@ -64,6 +64,41 @@ function createWindow() {
     mainWindow.loadFile(indexPath);
   }
 
+  // Allow iframes to load from any origin by removing X-Frame-Options headers
+  mainWindow.webContents.session.webRequest.onHeadersReceived(
+    (details, callback) => {
+      const headers = details.responseHeaders;
+
+      // Remove headers that block iframe embedding
+      if (headers) {
+        delete headers["x-frame-options"];
+        delete headers["X-Frame-Options"];
+
+        // Modify CSP to allow framing
+        if (headers["content-security-policy"]) {
+          headers["content-security-policy"] = headers["content-security-policy"]
+            .map(value => value.replace(/frame-ancestors[^;]*/gi, ''))
+            .filter(value => value.trim().length > 0);
+
+          if (headers["content-security-policy"].length === 0) {
+            delete headers["content-security-policy"];
+          }
+        }
+        if (headers["Content-Security-Policy"]) {
+          headers["Content-Security-Policy"] = headers["Content-Security-Policy"]
+            .map(value => value.replace(/frame-ancestors[^;]*/gi, ''))
+            .filter(value => value.trim().length > 0);
+
+          if (headers["Content-Security-Policy"].length === 0) {
+            delete headers["Content-Security-Policy"];
+          }
+        }
+      }
+
+      callback({ responseHeaders: headers });
+    }
+  );
+
   mainWindow.once("ready-to-show", () => {
     mainWindow.show();
   });

src/ui/Desktop/Authentication/ElectronLoginForm.tsx

@@ -326,8 +326,8 @@ export function ElectronLoginForm({
           src={serverUrl}
           className="w-full h-full border-0"
           title="Server Authentication"
-          sandbox="allow-same-origin allow-scripts allow-forms allow-popups allow-popups-to-escape-sandbox allow-storage-access-by-user-activation allow-top-navigation allow-top-navigation-by-user-activation"
-          allow="clipboard-read; clipboard-write; cross-origin-isolated"
+          sandbox="allow-same-origin allow-scripts allow-forms allow-popups allow-popups-to-escape-sandbox allow-storage-access-by-user-activation allow-top-navigation allow-top-navigation-by-user-activation allow-modals allow-downloads"
+          allow="clipboard-read; clipboard-write; cross-origin-isolated; camera; microphone; geolocation"
         />
       </div>
     </div>