iframe - How to "allow-from" more than one domain for "X-Frame-Options" in Rails 4 controller? -

4 applications in a Ruby on the track I am working on, I need to create a page that is dragged into an iframe Will be taken on foo.bar.com server, so I have this controller method:

  df iframed_page response.headers ["X-frame- Allow OPTIONS "] =" Http://foo.bar.com "end  

and now it is known that the customer is whitelisting me http: // foo .dev also wants .bar.com as well.

I know that to set the X-frame-option, "permission-to" option does not allow for multiple sub-domains. But since this is the same root domain with different subdomains, will it be a bit more flexible? For example, I can do something like "http: //*.bar.com" like

  response.headers ["X-frame-option"].  

as well?

You can use the content-security policy instead of the title, but this.

  response. Ideers ["X-content-security-policy"] = "fram-ancestors http: //*.bar.com"; reaction. Title ["content-security-policy"] = "fram-ancestors http: //*.bar.com";  

• Content-security policy will override x-frames-option on a very modern browser
< Li> X-content-security-policy will override x-frames-option on IE 11