@alcea Tell that instance admin to properly send iFrame headers. Misconfigured webserver. Also it’s quite annoying getting a mention almost every day, sometimes more than once in a row.
tl;dr: cloudfront by default sets the X-Frame-Options header to "SAMEORIGIN" and doesn't allow you to set it to "ALLOWALL", only 'DENY' or 'SAMEORIGIN'. So I had to make sure the CloudFront response headers were set up to pass the value that it was receiving from the webserver, which also meant properly configuring nginx to ignore the header value sent through the proxy and set it to ALLOWALL manually
I don't know if that's the RIGHT way to do it, but it's working so it can't be that wrong :)
Let me know if it stops working again as I'm going to continue tweaking settings for security
Add comment