I would like to configure Apache so that

  • it normally denies requests for iFrames (for instance, by setting Header always append X-Frame-Options DENY)
  • but, it allows a specific directory to be embedded as iFrame, independently from the origin of the request (for instance, <iframe src="www.mysite.com/mydir"></iframe>)

Is that possible?


See documentation for X-Frame-Options. You can

  • allow embedding from https://example.com/mydir:

    Header always append X-Frame-Options ALLOW-FROM=https://example.com/mydir
  • allow embedding of https://example.com/mydir
    by adding it only when Location doesn't match /mydir, with the LocationMatch directive.

    <VirtualHost *:80>
        ServerName example.com
        <LocationMatch "^/(?!mydir)(.*)">
            Header always append X-Frame-Options DENY
  • to maximize security, add a combination of these i.e. only allow embedding of /mydir from ....

You can't limit it to <iframe> alone, but the embedding can also be done as <frame> or <object>.

  • Thanks, it worked! I only had to invert the regexp match (my original request was to deny everything that is not under /mydir). – Alphaaa Jun 22 '17 at 14:37
  • My mistake! Now it should have correct negation, doesn't it? – Esa Jokinen Jun 22 '17 at 15:09
  • Yes, with my edit it works fine :) – Alphaaa Jun 23 '17 at 15:33
  • Uh, I see now that you rejected my edit. I had also corrected the wrong closing tag to </LocationMatch>. – Alphaaa Jun 23 '17 at 15:35
  • I didn't reject it, but when using the App I may have overwritten it with my own modification. Sorry. Edited the closing tag again. – Esa Jokinen Jun 23 '17 at 15:46

in my case it works only if i do like this

    <LocationMatch "^/mydir(.*)">
       Header always append X-Frame-Options DENY

in order to allow the /mydir folder...

EDIT: forget about what i said, this setting doesn't block anything

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.