Jakub Domeracki 49be5f31d3 fix(coderd): backport frame-ancestors CSP fixes to 2.31 (#24474, #24529) (#24807) ...

Cherry-pick backport of #24474 and #24529 to `release/2.31`.

- #24474: fix(coderd): add frame-ancestors CSP directive to prevent
clickjacking
- #24529: fix(coderd): omit frame-ancestors CSP for embed routes

Both commits cherry-picked cleanly with no conflicts.

> Generated by Coder Agents

2026-05-01 14:54:17 -04:00

..

loggermw

…

patternmatcher

…

actor_test.go

…

actor.go

…

apikey_test.go

…

apikey.go

…

authorize_test.go

…

authz_test.go

…

authz.go

…

clitelemetry.go

…

cors_test.go

…

cors.go

…

csp_test.go

fix(coderd): backport frame-ancestors CSP fixes to 2.31 (#24474, #24529) (#24807)

2026-05-01 14:54:17 -04:00

csp.go

fix(coderd): backport frame-ancestors CSP fixes to 2.31 (#24474, #24529) (#24807)

2026-05-01 14:54:17 -04:00

csrf_test.go

fix(coderd): harden OAuth2 provider security (#22194)

2026-02-23 12:18:44 +01:00

csrf.go

fix(coderd): harden OAuth2 provider security (#22194)

2026-02-23 12:18:44 +01:00

experiments.go

…

externalauthparam_test.go

…

externalauthparam.go

…

groupparam_test.go

…

groupparam.go

…

hsts_test.go

…

hsts.go

…

httpmw_internal_test.go

chore: remove unnecessary loop variable captures (#22180)

2026-02-19 09:02:19 +00:00

httpmw.go

…

httproute_test.go

…

httproute.go

…

notificationtemplateparam.go

…

oauth2_test.go

…

oauth2.go

…

organizationparam_test.go

…

organizationparam.go

…

pprof.go

…

prometheus_test.go

…

prometheus.go

…

provisionerdaemon.go

…

provisionerkey.go

…

ratelimit_test.go

…

ratelimit.go

…

realip_test.go

…

realip.go

…

requestid_test.go

…

requestid.go

…

rfc6750_extended_test.go

…

rfc6750_test.go

…

taskparam_test.go

…

taskparam.go

…

templateparam_test.go

…

templateparam.go

…

templateversionparam_test.go

…

templateversionparam.go

…

userparam_test.go

…

userparam.go

…

workspaceagent_test.go

…

workspaceagent.go

…

workspaceagentparam_test.go

…

workspaceagentparam.go

…

workspacebuildparam_test.go

…

workspacebuildparam.go

…

workspaceparam_test.go

…

workspaceparam.go

…

workspaceproxy_test.go

…

workspaceproxy.go

…

workspaceresourceparam_test.go

…

workspaceresourceparam.go

…