Search code examples
.htaccessx-frame-options

Modify headers x-frame-options in .htaccess

I'm trying to modify the x-frame-options in my .htaccess file. I would like for only one specific site to be allowed (apart from the sameorigin site) Although I am able to deny it for all, I have no clue on how to allow it for only one site, I have looked up the docs on MDN, but must have either overlooked something or I am not getting it correctly.

Code that did work to block all:

Header set X-Frame-Options DENY

None of the below examples did however work and resulted in a 500 external error

Header set X-Frame-Options ALLOW-FROM URL

Header set X-Frame-Options: ALLOW-FROM URL

X-Frame-Options: ALLOW-FROM URL

I have other code in the htaccess file and added all of the above to test on the first line of the file.

Thanks for any help.

Solution

  • "ALLOW-FROM uri" is not supported by all browsers. Ref: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Frame-Options