Retropex/mempool
1
0
Fork 0
mirror of https://github.com/Retropex/mempool.git synced 2025-05-12 18:20:41 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity

ops: Remove old X-Frame-Options HTTP header

Browse Source
This commit is contained in:
wiz 2025-02-19 10:56:13 -06:00
parent b22bceb349
commit c626bd1ea2
No known key found for this signature in database
GPG Key ID: A394E332255A6173
1 changed files with 2 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
production/nginx/server-common.conf
View File

@ -8,33 +8,28 @@ add_header Onion-Location http://$onion.onion$request_uri;
add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload";
# generate frame configuration from origin header
if ($frameOptions = '')
if ($contentSecurityPolicy = '')
{
set $frameOptions "DENY";
set $contentSecurityPolicy "frame-ancestors 'none'";
set $contentSecurityPolicy "frame-ancestors 'self'";
}
# used for iframes on https://mempool.space/network
if ($http_referer ~ ^https://mempool.space/)
{
set $frameOptions "ALLOW-FROM https://mempool.space";
set $contentSecurityPolicy "frame-ancestors https://mempool.space";
}
# used for iframes on https://mempool.ninja/network
if ($http_referer ~ ^https://mempool.ninja/)
{
set $frameOptions "ALLOW-FROM https://mempool.ninja";
set $contentSecurityPolicy "frame-ancestors https://mempool.ninja";
}
# used for iframes on https://wiz.biz/bitcoin/nodes
if ($http_referer ~ ^https://wiz.biz/)
{
set $frameOptions "ALLOW-FROM https://wiz.biz";
set $contentSecurityPolicy "frame-ancestors https://wiz.biz";
}
# restrict usage of frames
add_header X-Frame-Options $frameOptions;
add_header Content-Security-Policy $contentSecurityPolicy;
# enable browser and proxy caching