Search code examples
nginxserverx-frame-options

How can i exclude a specified path on my server from X-frame-options same origin?

I have the following problem. My page is protected by x-frame-options same origin. The use of this header is known to me and works well. But I would now like to exclude a path on my server (i.e. mydomain.net/embed/ ...). So that this can be embedded in an iframe and not the rest of the website. Website Server is NGINX. If statement should be avoided. How can i solve this?

Solution

  • Remove x-frame-options same origin header from http or server block

    Add x-frame-options same origin header on / location block and the excluded path /embed on separate location block 

    server {
    listen 80 default;
    server_name example.com;
    root /var/www/html/;

    location / {
        add_header X-Frame-Options "SAMEORIGIN";

    }

    location /embed/ {
        # Do nothing. 
    }
}