Skip to content

Instantly share code, notes, and snippets.

@geedew

geedew/whitelisted-x-frame-options

Created February 20, 2014 15:35
Show Gist options
  • Star 5 You must be signed in to star a gist
  • Fork 1 You must be signed in to fork a gist
  • Save geedew/9116449 to your computer and use it in GitHub Desktop.
Save geedew/9116449 to your computer and use it in GitHub Desktop.
Download ZIP
A whilte-listed Apache solution for X-Frame-Options SAMEORIGIN
Raw
whitelisted-x-frame-options
<VirtualHost *:80>
# ...
<IfModule mod_headers.c>
# Allow some urls, block all others; whitelisting
<LocationMatch ^((?!(firstUrlAllowed|secondUrlAllowed)).)*$>
Header always append X-Frame-Options SAMEORIGIN # Block any site from applying an iframe.
</LocationMatch>
</IfModule>
</VirtualHost>
@ganeshbabusatsyil
Copy link

Hi, is it not working for the pattern for Eg:: https://test.sub.entries.com.
Actually i tried with the string "entries" as well as full URL(https://test.sub.entries.com) in the firstUrlAllowed field.

Shall i need to add any thing extra? Please help me out.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment