Set x-frame-options to allow and disallow certain URLs to frame a page

Question

I want to prevent my website from being clickjacked by someone else. So in my .htaccess file, I placed this code (which is working correctly):

Header set X-Frame-Options SAMEORIGIN

My website is now secured from being iframed by any sites in the internet. However, I recently developed a mobile application that fetches pages under the about-us hosted in my website (my website contains www.mywebsite/about-us/author, www.mywebsite/about-us/company) to display the same details on the app. So what I did was I added the lines on my .htaccess file:

SetEnvIf REQUEST_URI ^about-us/$ aboutus_page
Header set X-Frame-Options SAMEORIGIN env=!aboutus_page

I want the rest of my pages to be free from being iframed except all pages under mywebsite/about-us/ "any page"

Answer 1

At least in Apache 2.4 %{REQUEST_URI} won't work for the usual SPA kind of URI. Use %{THE_REQUEST} instead. Then SetEnvIf is not as flexible so I recommend to use simply the // sections. Just tested the below and works:

<If "! %{THE_REQUEST} =~ /.*about-us.*/">
  Header set X-Frame-Options SAMEORIGIN
</If>