From d37083ae2a722e1b776d13e1f3c3cbf2e17ecb16 Mon Sep 17 00:00:00 2001 From: Johannes Löthberg Date: Tue, 5 Nov 2024 16:13:54 +0100 Subject: Disable X-Frame-Options for vault.kyriasis.com MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Apparently this breaks WebAuthn for the desktop client. Signed-off-by: Johannes Löthberg --- nginx/vault_kyriasis_com.sls | 3 --- 1 file changed, 3 deletions(-) diff --git a/nginx/vault_kyriasis_com.sls b/nginx/vault_kyriasis_com.sls index 758dd7b..19f9244 100644 --- a/nginx/vault_kyriasis_com.sls +++ b/nginx/vault_kyriasis_com.sls @@ -41,9 +41,6 @@ nginx: # https://developer.mozilla.org/en-US/docs/Security/HTTP_Strict_Transport_Security - add_header: 'Strict-Transport-Security "max-age=31536000"' - # Tell browsers not to render the page inside a frame, and avoid clickjacking. - - add_header: X-Frame-Options SAMEORIGIN - # Tell browsers to not try to auto-detect the Content-Type. - add_header: X-Content-Type-Options nosniff -- cgit v1.2.3-70-g09d2