fix(server): other sites can no longer frame the web app by juliusmarminge · Pull Request #36395 · pingdotgg/t3code

juliusmarminge · 2026-11-13T20:58:32Z

The web app served by an environment sent no anti-framing headers. Only the OAuth error pages set them. A page that shares the session cookie's site could frame the signed-in app and steer a click onto a one-click action, such as Approve on /connect-agent or a /new?prompt= link. The hosted /approve-agent page already refuses to render inside a frame. The local /connect-agent page only has an arm delay.

Fix: HTML responses from the static SPA handler now send Content-Security-Policy: frame-ancestors 'none' and X-Frame-Options: DENY, on both the streamed and fallback paths. Nothing frames the SPA itself: in-app iframes load attachments and assets from other routes, desktop loads the renderer over its own protocol, and the desktop browser panel is a native view. Vite dev serves its own index.html, so dev is unchanged.

The existing static HTML test now asserts both headers. It fails without the change.

🤖 Generated with Claude Code (Claude Opus 5.5)

The static SPA handler sent no anti-framing headers, so a page that shares the session cookie's site could frame the app and steer a click onto a one-click action such as approving an agent sign-in on /connect-agent. HTML responses now send `Content-Security-Policy: frame-ancestors 'none'` and `X-Frame-Options: DENY`. Co-Authored-By: Claude Opus 5.5 <[email protected]>

macroscopeapp · 2026-11-13T21:00:20Z

Approvability

Verdict: Needs Human Approval

Macroscope's review found this PR requires human approval — HTML responses will block all framing, reducing clickjacking exposure but also preventing legitimate embedding. Human confirmation is needed that this default restriction, including same-origin framing, is intended.

^{You can add or adjust custom eligibility rules. Learn more.}

github-actions · 2026-11-13T21:01:12Z

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

ℹ️ The exact PR base did not have a successful artifact. Baseline uses the latest successful main measurement shown below.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	5.0 KiB	5.0 KiB	0 B (0.0%)	6.8 KiB	✅
Codex	Thread snapshot wire	3.8 KiB	3.8 KiB	0 B (0.0%)	4.9 KiB	✅
Codex	Live turn WebSocket wire	1.2 KiB	1.2 KiB	0 B (0.0%)	2.0 KiB	✅
Codex	Live turn WebSocket decoded	21.5 KiB	21.5 KiB	0 B (0.0%)	24.4 KiB	✅
Codex	Live turn messages	1	1	0 (0.0%)	8	✅
Claude	Total thread wire	5.0 KiB	5.0 KiB	0 B (0.0%)	6.8 KiB	✅
Claude	Thread snapshot wire	3.8 KiB	3.8 KiB	0 B (0.0%)	4.9 KiB	✅
Claude	Live turn WebSocket wire	1.2 KiB	1.2 KiB	0 B (0.0%)	2.0 KiB	✅
Claude	Live turn WebSocket decoded	21.9 KiB	21.9 KiB	0 B (0.0%)	24.4 KiB	✅
Claude	Live turn messages	1	1	0 (0.0%)	8	✅

Other scenarios

All 64 scenario measurements match main.

All 64 scenario measurements

Provider	Scenario	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	`short turn resume`	`WebSocket decoded`	10.5 KiB	10.5 KiB	0 B (0.0%)	12.7 KiB	✅
Codex	`short turn resume`	`WebSocket messages`	2	2	0 (0.0%)	2	✅
Codex	`long turn running, cold open`	`HTTP decoded`	281.7 KiB	281.7 KiB	0 B (0.0%)	302.7 KiB	✅
Codex	`long turn running, cold open`	`rows`	75	75	0 (0.0%)	75	✅
Codex	`long turn running, history page`	`HTTP decoded`	92.4 KiB	92.4 KiB	0 B (0.0%)	107.4 KiB	✅
Codex	`long turn running, history page`	`rows`	75	75	0 (0.0%)	75	✅
Codex	`long turn finished, cold open`	`HTTP decoded`	381.5 KiB	381.5 KiB	0 B (0.0%)	410.2 KiB	✅
Codex	`long turn finished, cold open`	`rows`	151	151	0 (0.0%)	151	✅
Codex	`long turn finished, socket cold open`	`WebSocket decoded`	381.6 KiB	381.6 KiB	0 B (0.0%)	410.2 KiB	✅
Codex	`long turn finished, socket cold open`	`WebSocket messages`	2	2	0 (0.0%)	2	✅
Codex	`long turn finished, socket cold open`	`rows`	151	151	0 (0.0%)	151	✅
Codex	`long turn finished, work page`	`HTTP decoded`	186.2 KiB	186.2 KiB	0 B (0.0%)	200.2 KiB	✅
Codex	`long turn finished, work page`	`rows`	150	150	0 (0.0%)	150	✅
Codex	`idle thread resume`	`WebSocket decoded`	65 B	65 B	0 B (0.0%)	200 B	✅
Codex	`idle thread resume`	`WebSocket messages`	1	1	0 (0.0%)	1	✅
Codex	`fleet shell snapshot`	`HTTP decoded`	42.4 KiB	42.4 KiB	0 B (0.0%)	53.7 KiB	✅
Codex	`fleet shell snapshot`	`rows`	27	27	0 (0.0%)	27	✅
Codex	`fleet shell subscribe`	`WebSocket decoded`	65 B	65 B	0 B (0.0%)	200 B	✅
Codex	`fleet shell subscribe`	`WebSocket messages`	1	1	0 (0.0%)	1	✅
Codex	`fleet shell resume check`	`HTTP decoded`	18 B	18 B	0 B (0.0%)	100 B	✅
Codex	`fleet shell resume check`	`rows`	0	0	0	0	✅
Codex	`stale shell reload`	`HTTP decoded`	42.4 KiB	42.4 KiB	0 B (0.0%)	53.7 KiB	✅
Codex	`stale shell reload`	`rows`	27	27	0 (0.0%)	27	✅
Codex	`stale shell resume`	`WebSocket decoded`	140 B	140 B	0 B (0.0%)	400 B	✅
Codex	`stale shell resume`	`WebSocket messages`	2	2	0 (0.0%)	2	✅
Codex	`stale todo list cold open`	`HTTP decoded`	72.4 KiB	72.4 KiB	0 B (0.0%)	83.0 KiB	✅
Codex	`stale todo list cold open`	`rows`	75	75	0 (0.0%)	75	✅
Codex	`stale todo list cold open`	`nodes`	2	2	0 (0.0%)	4	✅
Codex	`stale todo list cold open`	`subagents`	2	2	0 (0.0%)	4	✅
Codex	`stale todo list cold open`	`plans`	1	1	0 (0.0%)	2	✅
Codex	`stale todo list cold open`	`providerTurns`	1	1	0 (0.0%)	2	✅
Codex	`stale todo list cold open`	`checkpoints`	1	1	0 (0.0%)	2	✅
Claude	`short turn resume`	`WebSocket decoded`	10.6 KiB	10.6 KiB	0 B (0.0%)	12.7 KiB	✅
Claude	`short turn resume`	`WebSocket messages`	2	2	0 (0.0%)	2	✅
Claude	`long turn running, cold open`	`HTTP decoded`	283.3 KiB	283.3 KiB	0 B (0.0%)	302.7 KiB	✅
Claude	`long turn running, cold open`	`rows`	75	75	0 (0.0%)	75	✅
Claude	`long turn running, history page`	`HTTP decoded`	93.4 KiB	93.4 KiB	0 B (0.0%)	107.4 KiB	✅
Claude	`long turn running, history page`	`rows`	75	75	0 (0.0%)	75	✅
Claude	`long turn finished, cold open`	`HTTP decoded`	384.2 KiB	384.2 KiB	0 B (0.0%)	410.2 KiB	✅
Claude	`long turn finished, cold open`	`rows`	151	151	0 (0.0%)	151	✅
Claude	`long turn finished, socket cold open`	`WebSocket decoded`	384.3 KiB	384.3 KiB	0 B (0.0%)	410.2 KiB	✅
Claude	`long turn finished, socket cold open`	`WebSocket messages`	2	2	0 (0.0%)	2	✅
Claude	`long turn finished, socket cold open`	`rows`	151	151	0 (0.0%)	151	✅
Claude	`long turn finished, work page`	`HTTP decoded`	188.1 KiB	188.1 KiB	0 B (0.0%)	200.2 KiB	✅
Claude	`long turn finished, work page`	`rows`	150	150	0 (0.0%)	150	✅
Claude	`idle thread resume`	`WebSocket decoded`	66 B	66 B	0 B (0.0%)	200 B	✅
Claude	`idle thread resume`	`WebSocket messages`	1	1	0 (0.0%)	1	✅
Claude	`fleet shell snapshot`	`HTTP decoded`	43.0 KiB	43.0 KiB	0 B (0.0%)	53.7 KiB	✅
Claude	`fleet shell snapshot`	`rows`	27	27	0 (0.0%)	27	✅
Claude	`fleet shell subscribe`	`WebSocket decoded`	66 B	66 B	0 B (0.0%)	200 B	✅
Claude	`fleet shell subscribe`	`WebSocket messages`	1	1	0 (0.0%)	1	✅
Claude	`fleet shell resume check`	`HTTP decoded`	18 B	18 B	0 B (0.0%)	100 B	✅
Claude	`fleet shell resume check`	`rows`	0	0	0	0	✅
Claude	`stale shell reload`	`HTTP decoded`	43.0 KiB	43.0 KiB	0 B (0.0%)	53.7 KiB	✅
Claude	`stale shell reload`	`rows`	27	27	0 (0.0%)	27	✅
Claude	`stale shell resume`	`WebSocket decoded`	140 B	140 B	0 B (0.0%)	400 B	✅
Claude	`stale shell resume`	`WebSocket messages`	2	2	0 (0.0%)	2	✅
Claude	`stale todo list cold open`	`HTTP decoded`	73.4 KiB	73.4 KiB	0 B (0.0%)	83.0 KiB	✅
Claude	`stale todo list cold open`	`rows`	75	75	0 (0.0%)	75	✅
Claude	`stale todo list cold open`	`nodes`	2	2	0 (0.0%)	4	✅
Claude	`stale todo list cold open`	`subagents`	2	2	0 (0.0%)	4	✅
Claude	`stale todo list cold open`	`plans`	1	1	0 (0.0%)	2	✅
Claude	`stale todo list cold open`	`providerTurns`	1	1	0 (0.0%)	2	✅
Claude	`stale todo list cold open`	`checkpoints`	1	1	0 (0.0%)	2	✅

Baseline: 0a6b3eb · PR result: 9ec2472 · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

Codex decoded thread snapshot: 108.5 KiB
Claude decoded thread snapshot: 108.8 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.

coderabbitai · 2026-11-13T21:01:56Z

No actionable comments were generated in the recent review.

Walkthrough

Static HTML responses now include Content-Security-Policy: frame-ancestors 'none' and X-Frame-Options: DENY in both response paths. The test checks for both headers.

Changes: Static HTML frame protection

Layer / File(s)	Summary
Add and validate static HTML frame headers `apps/server/src/http.ts`, `apps/server/src/http.test.ts`	Static HTML responses include the CSP and `X-Frame-Options` headers in both response paths. The test asserts that both headers are present.

Estimated code review effort: 2 (Simple) | ~8 minutes

Change: Bug fix

Merge Risk: Minimal · up to 9ec24

The change makes the server refuse to let other sites frame the web app by adding standard anti-framing headers to HTML responses. The change is small, additive, and easy to roll back. No concrete merge-blocking risk was found.

Pre-merge checks: 4

Check name	Status	Explanation
Title check		The title "fix(server): other sites can no longer frame the web app" matches the main change. The PR adds Content-Security-Policy frame-ancestors 'none' and X-Frame-Options: DENY to static SPA HTML re…
Description check		The description follows the template. It states the problem (no anti-framing headers, with a clickjacking risk on Approve and new-prompt actions) and the change (both headers on streamed and fallback …
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Title check

Explanation

The title "fix(server): other sites can no longer frame the web app" matches the main change. The PR adds Content-Security-Policy frame-ancestors 'none' and X-Frame-Options: DENY to static SPA HTML responses, which stops other sites from framing the app. The title is a conventional commit, specific, and written in plain language.

Full details: Description check

Explanation

The description follows the template. It states the problem (no anti-framing headers, with a clickjacking risk on Approve and new-prompt actions) and the change (both headers on streamed and fallback HTML paths, with a note on why in-app iframes and desktop are unaffected). It also covers scope by describing the security issue, and verification by stating the existing static HTML test now asserts both headers and fails without the change. The description does not link an issue or explain why no issue is needed, and the verification does not describe a manual or run check result beyond the claim that the test fails without the change. The template asks for a linked issue or a reason for none, and the model and harness line is present via the Claude Code attribution.

Finishing Touches

Generate unit tests (beta)

Commit to this branch
Create a new PR

Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Recent review info

Run configuration

Source mode: Auto

Repository: pingdotgg/t3code

Branch: fix/spa-frame-ancestors

File: .coderabbit.config.ts

Commit: 9ec2472

Layers: Repository TS config

Review profile: CHILL

Plan: Team

Run ID: `44bf8b5b-a0d6-40bf-993f-7f9a682c436f`

Commits

Reviewing files that changed from the base of the PR and between `9402dc3` and `9ec2472`.

Files selected for processing: 2

`apps/server/src/http.test.ts`

`apps/server/src/http.ts`

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 0 remain after this review.

* fix(server): Claude can show the user mid-turn text in full (pingdotgg#36384) * fix(cli): tagged source builds report the release version (pingdotgg#36350) Co-authored-by: Lakshmi Tanmay <[email protected]> * fix(server): storage cleanup prunes idle No project folders under ~/.t3/scratch (pingdotgg#36369) * fix(terminal): trimmed history no longer replays half of a control sequence (pingdotgg#36368) * fix(usage): a re-emitted Codex snapshot is no longer billed as a counter rewind (pingdotgg#36367) Co-authored-by: rihanaws <[email protected]> * fix(server): a Claude Monitor line no longer wakes a delegated child's parent (pingdotgg#36339) * fix(opencode): a lost subagent report no longer leaves a resumed call running (pingdotgg#36386) * fix(web): a new worktree thread opened during a clone bases on the real default branch (pingdotgg#36379) * fix(server): unauthenticated token requests no longer write DPoP replay markers (pingdotgg#36393) * fix(server): other sites can no longer frame the web app (pingdotgg#36395) * fix(server): a server browser tab survives a renderer crash, and a service worker badge call no longer causes one (pingdotgg#36389) * fix(web): T3 Connect sign-in offers Retry after Clerk fails to load (pingdotgg#23620) Co-authored-by: Claude Opus 5.5 <[email protected]> * fix(ci): macOS PR previews no longer run the PR's bundle next to signing secrets (pingdotgg#36407) * fix(mobile): a new thread's first message no longer returns to the composer after a lost launch reply (pingdotgg#32330) * fix(web): size markdown media whose width and height carry a px unit (pingdotgg#32108) * fix(web): file links the agent cited from a checkout it cd'd into open that file (pingdotgg#36364) * ci(mobile): iOS jobs run on macos-27, store builds require the final Xcode 27.1 (pingdotgg#36421) * fix(server): Claude context meter no longer shows an auto-compact point when auto-compaction is off (pingdotgg#36417) * fix(web): a run waiting on foreground subagents says so instead of Thinking (pingdotgg#36334) * fix(server): a follow-up to a delegated child waits for its awaited background work (pingdotgg#36411) * fix(provider-grok): Grok follow-ups queue instead of cancelling the running tool (pingdotgg#36422) * fix(server): thread list builds metadata only for the page it returns (pingdotgg#36434) * fix(web): middle-clicking empty chat space on Linux no longer pastes into the composer (pingdotgg#36436) * fix(web): closing Settings no longer leaves it as a back/forward stop (pingdotgg#36437) * fix(opencode): OpenCode 1.x threads report context-window usage (pingdotgg#36430) * fix(web): bare @ in the composer lists workspace files (pingdotgg#36435) * fix(mobile): thread list project filter lists recently active projects first (pingdotgg#36433) * fix(clients): live working timers count on the host's clock (pingdotgg#36420) * perf(relay): lighter Postgres load and PS-160 cluster (pingdotgg#36442) Co-authored-by: Claude Opus 5.5 <[email protected]> * fix(mobile): mobile:install --session works on pooled devices (pingdotgg#36447) * fix(native): KDE SnapShot no longer loses the first reply from KWin (pingdotgg#36218) Co-authored-by: Claude Fable 5.2 <[email protected]> * fix(server): t3 connect status no longer reports a publish-only link as exposed (pingdotgg#33967) * fix(web): don't label Windows paths outside the workspace as relative (pingdotgg#28469) Co-authored-by: Julius Marminge <[email protected]> * fix(server): multi-line guest messages are no longer refused or stored with CRLF (pingdotgg#26542) * perf(desktop): provider checks no longer compete with server startup (pingdotgg#35712) Co-authored-by: Claude Opus 5.5 <[email protected]> * fix(web,mobile): explain missing file access for host videos (pingdotgg#24637) * fix(scripts): iOS scenarios prepare the dev client before leasing a device (pingdotgg#36456) * perf(server): a new thread's first turn starts sooner (pingdotgg#35710) Co-authored-by: Claude Opus 5.5 <[email protected]> * fix(provider-pi): running shell output no longer stores a snapshot row per update (pingdotgg#36429) * fix(web): NVDA browse mode reads the current thread's branch, not the previous one (pingdotgg#34446) Co-authored-by: nibarAhmed <[email protected]> Co-authored-by: Julius Marminge <[email protected]> * fix(server): T3 Connect clients are named "T3 Connect", not "T3 Connect connect" (pingdotgg#27887) * fix(web): screen readers read the Update everything machine list as a table (pingdotgg#36445) * feat: agents can restyle T3 Code with theme colors and CSS (pingdotgg#35247) Co-authored-by: maria-rcks <[email protected]> Co-authored-by: Claude Fable 5.2 <[email protected]> * fix(mobile): long-pressed iOS blockquotes no longer draw over the thread (pingdotgg#36461) * fix(cli): npm launcher no longer leaves a runtime running after a stop signal (pingdotgg#30487) * feat(connect): require approval for new T3 Connect devices (pingdotgg#36419) Co-authored-by: Claude Opus 5.5 <[email protected]> * fix(server): run the Azure CLI in UTF-8 on Windows (pingdotgg#25801) Co-authored-by: Julius Marminge <[email protected]> * fix(server): preview navigation leaves a page whose script never yields (pingdotgg#36365) * fix(server): the auto-settle sweep no longer rereads every idle branch every few minutes (pingdotgg#36371) * fix(web): rewind no longer offers file restore in project-folder threads (pingdotgg#36467) * fix(server): stop the relay client a crashed server left running (pingdotgg#36465) * fix(server): read Azure DevOps pull request templates (pingdotgg#22881) * perf(azure-devops): PR Code tab loads a page's files in one az run instead of two per file (pingdotgg#35295) Co-authored-by: Julius Marminge <[email protected]> * fix(web): copying a file preview selection returns the selected lines after scrolling (pingdotgg#36466) * fix(mobile): push-token failures no longer report notifications as enabled (pingdotgg#26557) * fix(provider-core): mise updates a tool configured by its backend name (pingdotgg#36472) * fix(server): parent turns no longer duplicate delegated task thread items (pingdotgg#36473) * fix(server): Windows drive paths open under WSL (pingdotgg#26030) * fix(client-runtime): new T3 Connect machines appear without signing in again (pingdotgg#29788) * fix(azure-devops): local pull request checkout no longer fails on --detect (pingdotgg#31170) Co-authored-by: maria-rcks <[email protected]> Co-authored-by: Julius Marminge <[email protected]> * fix(usage): count shared Windows and WSL transcripts once (pingdotgg#24319) * fix(azure-devops): pull requests report build validation as checks (pingdotgg#31146) Co-authored-by: maria-rcks <[email protected]> Co-authored-by: Julius Marminge <[email protected]> * fix(desktop): WSL backend starts in distros without automounted drives (pingdotgg#25734) * fix(server): t3 browser setup reloads an AppArmor profile that is on disk but not loaded (pingdotgg#36490) * Initial plan * fix(azure-devops): finish reconciling nightly diff tests Remove retired files-diff code and update mocks for iteration changes and blob reads. Preserve bounded paging, cache, and error-path coverage. Co-authored-by: Copilot <[email protected]> --------- Co-authored-by: Julius Marminge <[email protected]> Co-authored-by: Lakshmi Tanmay <[email protected]> Co-authored-by: rihanaws <[email protected]> Co-authored-by: Claude Opus 5.5 <[email protected]> Co-authored-by: Theo Browne <[email protected]> Co-authored-by: ValeraZSD <[email protected]> Co-authored-by: nibarAhmed <[email protected]> Co-authored-by: nibarAhmed <[email protected]> Co-authored-by: maria-rcks <[email protected]> Co-authored-by: Pedro Henrique <[email protected]> Co-authored-by: Kieren-Foenander <[email protected]> Co-authored-by: Pavel Kroupa <[email protected]> Co-authored-by: copilot-swe-agent[bot] <[email protected]> Co-authored-by: Alex Vallone <[email protected]> Co-authored-by: Copilot <[email protected]>

github-actions Bot added vouch:trusted Author is trusted by repo permissions or the VOUCHED list. size:XS 0-9 changed lines (additions + deletions). labels Nov 13, 2026

juliusmarminge added [WIP - for content] WIP pull request opened for content review and removed [WIP - for content] WIP pull request opened for content review labels Nov 13, 2026

juliusmarminge merged commit 94aa3d7 into main Nov 13, 2026
52 checks passed

juliusmarminge deleted the fix/spa-frame-ancestors branch November 13, 2026 21:39

Navigation Menu

Repository navigation

fix(server): other sites can no longer frame the web app - #36395

fix(server): other sites can no longer frame the web app#36395
juliusmarminge merged 1 commit into
mainfrom
fix/spa-frame-ancestors

juliusmarminge commented Nov 13, 2026

Uh oh!

macroscopeapp Bot commented Nov 13, 2026

Uh oh!

github-actions Bot commented Nov 13, 2026

Uh oh!

coderabbitai Bot commented Nov 13, 2026

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

juliusmarminge commented Nov 13, 2026

Uh oh!

macroscopeapp Bot commented Nov 13, 2026

Approvability

Uh oh!

github-actions Bot commented Nov 13, 2026

Thread transfer impact

Other scenarios

Uh oh!

coderabbitai Bot commented Nov 13, 2026

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant