Add x-frame-options when hosting frontend pages

We don't want these pages to be contained in a frame. The x-frame-options servers that use.
2021-10-10 19:37:10 +02:00
parent db9b8bf65b
commit 6bdb5a7e57
2 changed files with 5 additions and 0 deletions
--- a/config/frontend/add-x-frame-options-header.conf
+++ b/config/frontend/add-x-frame-options-header.conf
@@ -0,0 +1,3 @@
+location / {
+  add_header X-Frame-Options "DENY";
+}
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -137,6 +137,8 @@ services:
    image: lblod/frontend-contact-hub:1.1.0
    labels:
      - "logging=true"
+    volumes:
+      - ./config/frontend/add-x-frame-options-header.conf:/config/add-x-frame-options.conf
    environment:
      EMBER_OAUTH_API_REDIRECT_URL: "https://organisaties.abb.lblod.info/authorization/callback"
      EMBER_OAUTH_API_KEY: "677af572-2e2f-4e61-ad38-036723bb314c"