From 6bdb5a7e579aa82ed2dd600c0ce3adf67e2c620c Mon Sep 17 00:00:00 2001 From: Aad Versteden Date: Sun, 10 Oct 2021 19:37:10 +0200 Subject: [PATCH] Add x-frame-options when hosting frontend pages We don't want these pages to be contained in a frame. The x-frame-options servers that use. --- config/frontend/add-x-frame-options-header.conf | 3 +++ docker-compose.yml | 2 ++ 2 files changed, 5 insertions(+) create mode 100644 config/frontend/add-x-frame-options-header.conf diff --git a/config/frontend/add-x-frame-options-header.conf b/config/frontend/add-x-frame-options-header.conf new file mode 100644 index 0000000..7f4234b --- /dev/null +++ b/config/frontend/add-x-frame-options-header.conf @@ -0,0 +1,3 @@ +location / { + add_header X-Frame-Options "DENY"; +} \ No newline at end of file diff --git a/docker-compose.yml b/docker-compose.yml index 1d70be0..a513537 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -137,6 +137,8 @@ services: image: lblod/frontend-contact-hub:1.1.0 labels: - "logging=true" + volumes: + - ./config/frontend/add-x-frame-options-header.conf:/config/add-x-frame-options.conf environment: EMBER_OAUTH_API_REDIRECT_URL: "https://organisaties.abb.lblod.info/authorization/callback" EMBER_OAUTH_API_KEY: "677af572-2e2f-4e61-ad38-036723bb314c"