chore: temporarily remove X-Frame-Options DENY header (#9441)

Co-authored-by: Off <[email protected]>
openfoodfacts · Nov 30, 2023 · 35dd8d4 · 35dd8d4
1 parent ace9eba
commit 35dd8d4
Show file tree

Hide file tree

Showing 2 changed files with 3 additions and 2 deletions.
diff --git a/conf/nginx/snippets/ssl-headers.conf b/conf/nginx/snippets/ssl-headers.conf
@@ -6,5 +6,5 @@
 #add_header Strict-Transport-Security "max-age=63072000; includeSubdomains; preload";
 #add_header Strict-Transport-Security "max-age=63072000; includeSubdomains";
 add_header Strict-Transport-Security "max-age=63072000";
-add_header X-Frame-Options DENY;
+#add_header X-Frame-Options DENY;
 add_header X-Content-Type-Options nosniff;
diff --git a/lib/ProductOpener/Display.pm b/lib/ProductOpener/Display.pm
@@ -610,7 +610,8 @@ sub init_request ($request_ref = {}) {
 	$country = 'en:world';
 
 	$r->headers_out->set(Server => "Product Opener");
-	$r->headers_out->set("X-Frame-Options" => "DENY");
+	# temporarily remove X-Frame-Options: DENY, needed for graphs - 2023/11/23
+	#$r->headers_out->set("X-Frame-Options" => "DENY");
 	$r->headers_out->set("X-Content-Type-Options" => "nosniff");
 	$r->headers_out->set("X-Download-Options" => "noopen");
 	$r->headers_out->set("X-XSS-Protection" => "1; mode=block");