apache2 - Apache config: allow iFrames only for a specific directory

itemprop="text">

I would like to configure Apache so
that

• it normally denies
  requests for iFrames (for instance, by setting Header always append
X-Frame-Options
DENY)


• but, it
  allows a specific directory to be embedded as iFrame, independently from the origin of
  the request (for instance, src="www.mysite.com/mydir">)

Is
that possible?

itemprop="text">

class="normal">Answer

See
documentation for href="https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Frame-Options"
rel="nofollow noreferrer">X-Frame-Options. You
can

• allow
  embedding from
  https://example.com/mydir:

  
  
  

  Header
              always append X-Frame-Options
              ALLOW-FROM=https://example.com/mydir
  
  




• allow
  embedding of
  https://example.com/mydir
  by adding it only when
  Location doesn't match /mydir, with
  the rel="nofollow noreferrer">LocationMatch
  directive.

  
  
  

              *:80>
   ServerName example.com
  
               "^/(?!mydir)(.*)">
   Header always append X-Frame-Options DENY
  
              
  
  
  




• to
  maximize security, add a combination of these i.e. only allow embedding of
  /mydir from
  ....

You
can't limit it to