Merge pull request #54 from lblod/feature/x-frame-options

Add x-frame-options when hosting frontend pages
2021-10-13 16:14:19 +02:00
parent db9b8bf65b 1c25a0192c
commit 333c85f027
2 changed files with 5 additions and 0 deletions
--- a/config/frontend/add-x-frame-options-header.conf
+++ b/config/frontend/add-x-frame-options-header.conf
@@ -0,0 +1,3 @@
+location / {
+  add_header X-Frame-Options "DENY" always;
+}
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -137,6 +137,8 @@ services:
    image: lblod/frontend-contact-hub:1.1.0
    labels:
      - "logging=true"
+    volumes:
+      - ./config/frontend/add-x-frame-options-header.conf:/config/add-x-frame-options.conf
    environment:
      EMBER_OAUTH_API_REDIRECT_URL: "https://organisaties.abb.lblod.info/authorization/callback"
      EMBER_OAUTH_API_KEY: "677af572-2e2f-4e61-ad38-036723bb314c"