Xframe settings test

TechnologyEnhancedLearning · Oct 25, 2024 · d103940 · d103940
1 parent de21044
commit d103940
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/DigitalLearningSolutions.Web/Startup.cs b/DigitalLearningSolutions.Web/Startup.cs
@@ -596,11 +596,11 @@ public void Configure(IApplicationBuilder app, IMigrationRunner migrationRunner,
                     "font-src https://script.hotjar.com https://assets.nhs.uk/; " +
                     "connect-src 'self' http: ws:; " +
                     "img-src 'self' data: https:; " +
+                    "frame-ancestors *" +
                     "frame-src 'self' https:");
                 context.Response.Headers.Add("Referrer-Policy", "no-referrer");
                 context.Response.Headers.Add("Strict-Transport-Security", "max-age=31536000; includeSubDomains");
                 context.Response.Headers.Add("X-Content-Type-Options", "nosniff");
-                context.Response.Headers.Add("X-Frame-Options", "deny");
                 context.Response.Headers.Add("X-XSS-protection", "0");
                 await next();
             });