How to omit the X-Frame-Options header for a specific path

Help
1

1. Caddy version (caddy version):

Caddy v2

2. How I run Caddy:

Running on Windows Server 2019 Std

3. The problem I’m having:

I need to omit the X-Frame-Options "SAMEORIGIN" header for a specific path only

For example, when the users are trying to include a subpage from my site inside an iframe, the header needs to be omitted from the server response to allow the browsers to load the iframe content.

So, when the users are going to /scheduling/(...) the header should not be sent.

Right now, I am including the security headers in the config

header * {
	X-XSS-Protection "1; mode=block"
	X-Frame-Options "SAMEORIGIN"
}

Thanks for the help!
Art

2

Use request matchers to either only send those headers for not path /scheduling/*, or remove the header only for /scheduling/*.

@opts not path /scheduling/* 
header @opts {
	X-XSS-Protection "1; mode=block"
	X-Frame-Options "SAMEORIGIN"
}

Or, by removing the header afterwards only for a certain path (note the - before the header field name which means “remove”)

route {
	header {
		X-XSS-Protection "1; mode=block"
		X-Frame-Options "SAMEORIGIN"
	}
	header /scheduling/* -X-Frame-Options "SAMEORIGIN"
}
2 Likes
3

@francislavoie as always you came just in time to the rescue!!! Thank you Sir!!!

1 Like
4

This topic was automatically closed after 30 days. New replies are no longer allowed.