From 794d003d30ea215284d3057c033018eb74a71f67 Mon Sep 17 00:00:00 2001
From: StephenCWills <swills@gridprotectionalliance.org>
Date: Thu, 13 Aug 2026 10:55:53 -0400
Subject: [PATCH] Add Content-Security-Policy header to disallow clickjacking
 exploits

---
 Source/Applications/SystemCenter/Startup.cs | 1 +
 1 file changed, 1 insertion(+)

diff --git a/Source/Applications/SystemCenter/Startup.cs b/Source/Applications/SystemCenter/Startup.cs
index 83479f976d..8f57368ffd 100644
--- a/Source/Applications/SystemCenter/Startup.cs
+++ b/Source/Applications/SystemCenter/Startup.cs
@@ -47,6 +47,7 @@ public void Configuration(IAppBuilder app)
             app.Use(async (context, next) =>
             {
                 context.Request.Environment["AuthenticationOptions"] = AuthenticationOptions.Readonly;
+                context.Response.Headers.Add("Content-Security-Policy", ["frame-ancestors 'none'"]);
                 await next.Invoke();
                 context.Response.Headers.Remove("Server");
             });