Skip to main content

apache2 - Apache config: allow iFrames only for a specific directory



I would like to configure Apache so that




  • it normally denies requests for iFrames (for instance, by setting Header always append X-Frame-Options DENY)

  • but, it allows a specific directory to be embedded as iFrame, independently from the origin of the request (for instance, )




Is that possible?


Answer



See documentation for X-Frame-Options. You can




  • allow embedding from https://example.com/mydir:



    Header always append X-Frame-Options ALLOW-FROM=https://example.com/mydir


  • allow embedding of https://example.com/mydir
    by adding it only when Location doesn't match /mydir, with the LocationMatch directive.




        ServerName example.com

        
            Header always append X-Frame-Options DENY



  • to maximize security, add a combination of these i.e. only allow embedding of /mydir from ....




You can't limit it to