Vishva/citpl_cms_react_express_postgres
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

asset path and iframe setting

Browse Source
This commit is contained in:
sandhiya-hepl
2026-07-16 10:57:25 +05:30
parent ed459d5943
commit 5b27debfa8
13 changed files with 131 additions and 67 deletions
Download Patch File Download Diff File Expand all files Collapse all files
dist/.htaccess
Vendored
+8 -7
View File
@@ -1,4 +1,4 @@
# Deployed under /citpl_website/ — Apache must proxy API to the Node server.
# Deployed under /citpl_website/ - Apache must proxy API to the Node server.
# Requires: mod_rewrite, mod_proxy, mod_proxy_http, mod_headers
# Start Node on the host: npm run server (or pm2 start server/index.js)
@@ -11,17 +11,18 @@
RewriteRule ^uploads/(.*)$ http://127.0.0.1:3001/uploads/$1 [P,L]
</IfModule>
# Allow admin login preview iframe (same origin)
# Allow embedding from this site and https://demo.cavinkare.in/
# X-Frame-Options cannot allow a third origin - unset it and use CSP only.
<IfModule mod_headers.c>
Header always edit Content-Security-Policy "frame-ancestors 'none'" "frame-ancestors 'self'"
Header always edit X-Frame-Options "DENY" "SAMEORIGIN"
Header always unset X-Frame-Options
Header unset X-Frame-Options
Header always edit Content-Security-Policy "frame-ancestors 'none'" "frame-ancestors 'self' https://demo.cavinkare.in/"
<FilesMatch "^(preview\.html|index\.html)$">
<FilesMatch "^(preview\.html|index\.html|admin\.html)$">
Header unset X-Frame-Options
Header always unset X-Frame-Options
Header unset Content-Security-Policy
Header always unset Content-Security-Policy
Header always set X-Frame-Options "SAMEORIGIN"
Header always set Content-Security-Policy "frame-ancestors 'self'"
Header always set Content-Security-Policy "frame-ancestors 'self' https://demo.cavinkare.in/"
</FilesMatch>
</IfModule>