From 3769057e791dbf5cb173129178e79ba14779f9d4 Mon Sep 17 00:00:00 2001 From: Paul Bakaus Date: Thu, 9 Apr 2026 08:11:34 -0700 Subject: [PATCH] Use SAMEORIGIN globally instead of per-path X-Frame-Options override Cloudflare Pages merges headers from all matching rules rather than overriding, so the path-specific SAMEORIGIN conflicted with the global DENY. Switch the global rule to SAMEORIGIN since the site only frames its own antipattern example pages. Co-Authored-By: Claude Opus 4.6 (1M context) --- scripts/build.js | 6 +----- 1 file changed, 1 insertion(+), 5 deletions(-) diff --git a/scripts/build.js b/scripts/build.js index e2a3759ba..621ca683a 100644 --- a/scripts/build.js +++ b/scripts/build.js @@ -477,7 +477,7 @@ function generateCFConfig(buildDir) { // _headers: security + cache headers const headers = `/* X-Content-Type-Options: nosniff - X-Frame-Options: DENY + X-Frame-Options: SAMEORIGIN # HTML pages: browser always revalidates, CDN caches 1h /*.html @@ -503,10 +503,6 @@ function generateCFConfig(buildDir) { /antipattern-images/* Cache-Control: public, max-age=604800, stale-while-revalidate=86400 -# Antipattern examples: allow same-origin framing (visual-mode page embeds these) -/antipattern-examples/* - X-Frame-Options: SAMEORIGIN - # Root static assets (favicon, og-image, etc.) /favicon.svg Cache-Control: public, max-age=604800, stale-while-revalidate=86400