Changing X-Frame-Options to allow-from doesn't succeed in .toml file

Questions / Help
6

Not sure what’s up there. If you have 3 apps, are you definitely deploying to the one you expect? Does fly status (pointing to the correct app) show you what you expect?

The other thing is to check your whitespace and maybe move those options to last.

I don’t really think this should matter, but maybe lets be sure! Here’s what works for me:

# fly.toml file generated for dumptests on 2023-03-17T15:11:40-04:00

app = "dumptests"
kill_signal = "SIGINT"
kill_timeout = 5
primary_region = "bos"
processes = []

[build]
  [build.args]
    NODE_VERSION = "14"
    PHP_VERSION = "8.2"

[env]
  APP_ENV = "production"
  LOG_CHANNEL = "stderr"
  LOG_LEVEL = "info"
  LOG_STDERR_FORMATTER = "Monolog\\Formatter\\JsonFormatter"

[experimental]
  auto_rollback = true

[[services]]
  http_checks = []
  internal_port = 8080
  processes = ["app"]
  protocol = "tcp"
  script_checks = []
  [services.concurrency]
    hard_limit = 25
    soft_limit = 20
    type = "connections"

  [[services.ports]]
    force_https = true
    handlers = ["http"]
    port = 80

  [[services.ports]]
    handlers = ["tls", "http"]
    port = 443

  [[services.tcp_checks]]
    grace_period = "1s"
    interval = "15s"
    restart_limit = 0
    timeout = "2s"

  [services.ports.http_options.response.headers]
    X-Frame-Options = false
    Content-Security-Policy = "frame-ancestors https://dumptests.fly.dev"

If you can’t get that working, try creating a new app to see if the same settings Just Work on that new application (you can destroy that new application later if you want). If the new application Just Works™, we can see if some issue is specific to that one app that’s not picking up those issues.