iframe - How to "allow-from" more than one domain for "X-Frame-Options" in Rails 4 controller? -
4 applications in a Ruby on the track I am working on, I need to create a page that is dragged into an iframe Will be taken on foo.bar.com server, so I have this controller method:
df iframed_page response.headers ["X-frame- Allow OPTIONS "] =" Http://foo.bar.com "end and now it is known that the customer is whitelisting me http: // foo .dev also wants .bar.com as well.
I know that to set the X-frame-option, "permission-to" option does not allow for multiple sub-domains. But since this is the same root domain with different subdomains, will it be a bit more flexible? For example, I can do something like "http: //*.bar.com" like
response.headers ["X-frame-option"]. as well?
You can use the content-security policy instead of the title, but this.
response. Ideers ["X-content-security-policy"] = "fram-ancestors http: //*.bar.com"; reaction. Title ["content-security-policy"] = "fram-ancestors http: //*.bar.com"; -
Content-security policywill overridex-frames-optionon a very modern browser < Li>
X-content-security-policy will override x-frames-option on IE 11
Comments
Post a Comment