I have some static assets that I want to serve inside iframes of several desktop / mobile web clients.
Now, how do I whitelist a specific set of origins to be allowed setting of X-Frame-Options headers so that the resource can be embedded as iframes inside different desktop / mobile web clients. and for all other origins denies the access to this resource.
With a little digging I started off with -
const app = express();
var allowCrossDomain = function (req, res, next) {
res.header('Access-Control-Allow-Origin', '*');
res.header('Access-Control-Allow-Methods', 'GET,PUT,POST,DELETE,OPTIONS');
res.header('Access-Control-Allow-Headers', 'Content-Type, X-Requested-With, Authorization');
if (req.method === "OPTIONS") res.send(200);
else next();
}
app.use(allowCrossDomain);
Now here how do I set the X-Frame-Options header with the whitelisted origin values here -
You should import helmet and use frameguard to get some origins whitelisted. More on this topic: MDN X-FRAME-OPTIONS Best Practice Security
all you need is helmet
npm install helmet --save
const express = require('express')
const helmet = require('helmet')
const app = express()
app.use(helmet.frameguard())
If you love us? You can donate to us via Paypal or buy me a coffee so we can maintain and grow! Thank you!
Donate Us With