Created
February 20, 2014 15:35
-
-
Save geedew/9116449 to your computer and use it in GitHub Desktop.
A whilte-listed Apache solution for X-Frame-Options SAMEORIGIN
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| <VirtualHost *:80> | |
| # ... | |
| <IfModule mod_headers.c> | |
| # Allow some urls, block all others; whitelisting | |
| <LocationMatch ^((?!(firstUrlAllowed|secondUrlAllowed)).)*$> | |
| Header always append X-Frame-Options SAMEORIGIN # Block any site from applying an iframe. | |
| </LocationMatch> | |
| </IfModule> | |
| </VirtualHost> |
Really nice fix! I tried a lot options with allow from with url but i didn't work or it worked but not in all the browsers..
Thank you!
You need to remove the comment after SAMEORIGN. It cause a too many parameters error !
The line must contain only : Header always append X-Frame-Options SAMEORIGIN
BTW thx for the fix =)
Hi, is it not working for the pattern for Eg:: https://test.sub.entries.com.
Actually i tried with the string "entries" as well as full URL(https://test.sub.entries.com) in the firstUrlAllowed field.
Shall i need to add any thing extra? Please help me out.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Note the
firstUrlAllowedandsecondUrlAllowed. These are simply strings that you expect to see in a URL. if they are found anywhere in the URL, then the Header will not be added. If you remove the ! then the header will only be applied when the URL contains those strings.