Nicolas Dos Santos 6b2550ff49 fix(csp): allow cross-subdomain framing for Pro page variant switcher (#1332) ...

* fix(csp): allow cross-subdomain framing and add finance to frame-src

frame-ancestors 'self' blocked tech/finance variants from rendering
inside the Pro landing page iframe. Widen to *.worldmonitor.app.
Also adds missing finance.worldmonitor.app to frame-src.

Closes #1322

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* fix(csp): remove conflicting X-Frame-Options and tighten frame-ancestors

X-Frame-Options: SAMEORIGIN contradicts the new frame-ancestors directive
that allows cross-subdomain framing. Modern browsers prioritize
frame-ancestors over X-Frame-Options, but sending both is contradictory
and gets flagged by security scanners. Remove X-Frame-Options entirely.

Also replace wildcard *.worldmonitor.app with explicit subdomain list
to limit the framing scope to known variants only.

---------

Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
Co-authored-by: Elie Habib <elie.habib@gmail.com>

2026-03-09 14:26:02 +04:00

..

.dockerignore

fix(railway): move .dockerignore to docker/ to unblock Nixpacks builds (#1336)

2026-03-09 13:24:15 +04:00

docker-entrypoint.sh

fix(docker): move Dockerfile to docker/ to prevent Railway auto-detection (#1334)

2026-03-09 12:43:57 +04:00

Dockerfile

fix(docker): move Dockerfile to docker/ to prevent Railway auto-detection (#1334)

2026-03-09 12:43:57 +04:00

nginx-security-headers.conf

fix(csp): allow cross-subdomain framing for Pro page variant switcher (#1332)

2026-03-09 14:26:02 +04:00

nginx.conf.template

fix(docker): move Dockerfile to docker/ to prevent Railway auto-detection (#1334)

2026-03-09 12:43:57 +04:00