diff --git a/web/next.config.js b/web/next.config.js
index f1c69ded6e..847a5f6b32 100644
--- a/web/next.config.js
+++ b/web/next.config.js
@@ -27,20 +27,20 @@ const nextConfig = {
   basePath,
   assetPrefix,
   webpack: (config, { dev, isServer }) => {
-    config.plugins.push(codeInspectorPlugin({ bundler: 'webpack' }))
-    return config
+    config.plugins.push(codeInspectorPlugin({ bundler: "webpack" }));
+    return config;
   },
   productionBrowserSourceMaps: false, // enable browser source map generation during the production build
   // Configure pageExtensions to include md and mdx
-  pageExtensions: ['ts', 'tsx', 'js', 'jsx', 'md', 'mdx'],
+  pageExtensions: ["ts", "tsx", "js", "jsx", "md", "mdx"],
   // https://nextjs.org/docs/messages/next-image-unconfigured-host
   images: {
-    remotePatterns: remoteImageURLs.map(remoteImageURL => ({
-      protocol: remoteImageURL.protocol.replace(':', ''),
+    remotePatterns: remoteImageURLs.map((remoteImageURL) => ({
+      protocol: remoteImageURL.protocol.replace(":", ""),
       hostname: remoteImageURL.hostname,
       port: remoteImageURL.port,
       pathname: remoteImageURL.pathname,
-      search: '',
+      search: "",
     })),
   },
   experimental: {},
@@ -50,17 +50,17 @@ const nextConfig = {
     // your project has ESLint errors.
     ignoreDuringBuilds: true,
     dirs: [
-      'app',
-      'bin',
-      'config',
-      'context',
-      'hooks',
-      'i18n',
-      'models',
-      'service',
-      'test',
-      'types',
-      'utils',
+      "app",
+      "bin",
+      "config",
+      "context",
+      "hooks",
+      "i18n",
+      "models",
+      "service",
+      "test",
+      "types",
+      "utils",
     ],
   },
   typescript: {
@@ -71,30 +71,30 @@ const nextConfig = {
   async redirects() {
     return [
       {
-        source: '/',
-        destination: '/apps',
+        source: "/",
+        destination: "/apps",
         permanent: false,
       },
-    ]
+    ];
   },
-  output: 'standalone',
+  output: "standalone",
   async headers() {
     return [
       {
-        source: '/(.*)', // 匹配所有路由
+        source: "/(.*)", // 匹配所有路由
         headers: [
           {
-            key: 'X-Frame-Options',
-            value: 'SAMEORIGIN', // 或 ALLOWALL（更宽松）
+            key: "X-Frame-Options",
+            value: "ALLOWALL", // 或 ALLOWALL（更宽松）
           },
           {
-            key: 'Content-Security-Policy',
-            value: 'frame-ancestors \'self\' *', // 可嵌套来源
+            key: "Content-Security-Policy",
+            value: `default-src 'none'`, //允许所有
           },
         ],
       },
-    ]
+    ];
   },
-}
+};
 
 module.exports = withBundleAnalyzer(withMDX(nextConfig))