Add CSP logic

app.py

@@ -9,6 +9,7 @@ from fastapi import FastAPI, File, UploadFile, HTTPException, Form, Request
 from fastapi.responses import FileResponse, HTMLResponse, JSONResponse
 from collections import OrderedDict
 import base64
+from starlette.responses import Response
 
 # Set up basic logging configuration
 logging.basicConfig(level=logging.DEBUG, format='%(asctime)s - %(levelname)s - %(message)s')
@@ -161,18 +162,16 @@ async def serve_main_page(request: Request):
                 var iframe = document.getElementById('flet-app-frame');
                 var currentProtocol = window.location.protocol;
                 var currentHost = window.location.host;
-                var src;
-
-                if (currentHost.includes('Danisz')) {
-                    // Force HTTPS for Danisz's Hugging Face space
-                    src = 'https://' + currentHost + '/flet-app';
-                } else {
-                    // Use the current protocol for other environments
-                    src = currentProtocol + '//' + currentHost + '/flet-app';
-                }
+                var src = currentProtocol + '//' + currentHost + '/flet-app/';
 
                 iframe.src = src;
                 console.log('Iframe src set to:', src);
+
+                // Set Content-Security-Policy based on the current protocol
+                var meta = document.createElement('meta');
+                meta.httpEquiv = "Content-Security-Policy";
+                meta.content = currentProtocol === 'https:' ? "upgrade-insecure-requests" : "";
+                document.head.appendChild(meta);
             };
         </script>
     </body>