Skip to content

Instantly share code, notes, and snippets.

@geedew

geedew/whitelisted-x-frame-options

Created February 20, 2014 15:35
Show Gist options
  • Star 5 You must be signed in to star a gist
  • Fork 1 You must be signed in to fork a gist
  • Save geedew/9116449 to your computer and use it in GitHub Desktop.
Save geedew/9116449 to your computer and use it in GitHub Desktop.
Download ZIP
A whilte-listed Apache solution for X-Frame-Options SAMEORIGIN
Raw
whitelisted-x-frame-options
<VirtualHost *:80>
# ...
<IfModule mod_headers.c>
# Allow some urls, block all others; whitelisting
<LocationMatch ^((?!(firstUrlAllowed|secondUrlAllowed)).)*$>
Header always append X-Frame-Options SAMEORIGIN # Block any site from applying an iframe.
</LocationMatch>
</IfModule>
</VirtualHost>
@geedew
Copy link
Author

geedew commented Feb 22, 2014

Note the firstUrlAllowed and secondUrlAllowed. These are simply strings that you expect to see in a URL. if they are found anywhere in the URL, then the Header will not be added. If you remove the ! then the header will only be applied when the URL contains those strings.

@dannyvdberg
Copy link

Really nice fix! I tried a lot options with allow from with url but i didn't work or it worked but not in all the browsers..

Thank you!

@pachou19
Copy link

pachou19 commented Jan 2, 2017 •
edited

You need to remove the comment after SAMEORIGN. It cause a too many parameters error !
The line must contain only : Header always append X-Frame-Options SAMEORIGIN
BTW thx for the fix =)

@ganeshbabusatsyil
Copy link

Hi, is it not working for the pattern for Eg:: https://test.sub.entries.com.
Actually i tried with the string "entries" as well as full URL(https://test.sub.entries.com) in the firstUrlAllowed field.

Shall i need to add any thing extra? Please help me out.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment