restrict iframe usage to mitigate clickjacking

Author: gchartier

package.json

@@ -1,6 +1,6 @@
 {
     "name": "orcfax.io",
-    "version": "2025-05-20",
+    "version": "2025-07-21",
     "private": true,
     "scripts": {
         "dev": "vite dev",

src/hooks.server.ts

@@ -0,0 +1,9 @@
+import type { Handle } from "@sveltejs/kit";
+
+export const handle: Handle = async ({ event, resolve }) => {
+    const response = await resolve(event);
+    response.headers.set("X-Frame-Options", "SAMEORIGIN");
+    response.headers.set("Content-Security-Policy", "frame-ancestors 'none'");
+
+    return response;
+};