add xframe options and more limited cors allowance

Pixilib · Sep 1, 2024 · e3dbdf7 · e3dbdf7
1 parent 99f3458
commit e3dbdf7
Show file tree

Hide file tree

Showing 2 changed files with 2 additions and 1 deletion.
diff --git a/GaelO2/config/cors.php b/GaelO2/config/cors.php
@@ -19,7 +19,7 @@
 
     'allowed_methods' => ['*'],
 
-    'allowed_origins' => ['*'],
+    'allowed_origins' => ['*.gaelo.fr', '*.pixilib.fr'],
 
     'allowed_origins_patterns' => ['*'],
 

diff --git a/nginx.conf b/nginx.conf
@@ -50,6 +50,7 @@ http {
         server_tokens off;
         add_header X-Content-Type-Options "nosniff" always;
         add_header X-XSS-Protection "1; mode=block" always;
+        add_header X-Frame-Options "SAMEORIGIN";
 
         root /var/www/public;
         index index.php;