updates

Backend/src/security/middleware/security.py

@@ -10,7 +10,12 @@ class SecurityHeadersMiddleware(BaseHTTPMiddleware):
     async def dispatch(self, request: Request, call_next):
         response = await call_next(request)
         security_headers = {'X-Content-Type-Options': 'nosniff', 'X-Frame-Options': 'DENY', 'X-XSS-Protection': '1; mode=block', 'Referrer-Policy': 'strict-origin-when-cross-origin', 'Permissions-Policy': 'geolocation=(), microphone=(), camera=()'}
-        security_headers.setdefault('Cross-Origin-Resource-Policy', 'cross-origin')
+        # Allow cross-origin resource sharing for uploads/images
+        # This is needed for images to load from different origins in development
+        if '/uploads/' in str(request.url):
+            security_headers.setdefault('Cross-Origin-Resource-Policy', 'cross-origin')
+        else:
+            security_headers.setdefault('Cross-Origin-Resource-Policy', 'same-origin')
         if settings.is_production:
             # Enhanced CSP with stricter directives
             # Using 'strict-dynamic' for better security with nonce-based scripts