Set clickjacking headers on Render (X-Frame-Options / frame-ancestors)

PlasticDigits commented

2026-08-25 07:00:10 +00:00

(Migrated from gitlab.com)

Summary

After merging !8 / closing #1, production still does not send clickjacking defenses. PROJECT_GUIDE.md §15b and skills/cl8y-site-positioning/invariants.md document that this static SPA should send X-Frame-Options: DENY or Content-Security-Policy: frame-ancestors 'none'. render.yaml has no headers today. The marketing page must not become a frameable wallet/connect surface.

This is host config on Render (and any CDN in front), not homepage copy.

Related: leftover CEX rows in src/data/links.ts stay with #2 (token directory). Do not remount retired homepage modules.

Acceptance criteria

Production responses for cl8y.com (and preview if used) include X-Frame-Options: DENY and/or Content-Security-Policy with frame-ancestors 'none'.
render.yaml (or the Render dashboard equivalent) is the source of truth so a fresh deploy keeps the header.
No new frameable wallet-connect widget is introduced on the marketing site.
Document the live header in PROJECT_GUIDE.md once confirmed (curl -I against production).

Test plan

curl -sI https://cl8y.com (and the Render URL) shows the header.
A simple iframe embed of / is blocked by the browser.
Redeploy from main and re-check so the header is not dashboard-only drift.

Out of scope

Token directory / AscendEX purge (#2).
Deleting unmounted retired modules.

## Summary After merging !8 / closing #1, production still does not send clickjacking defenses. `PROJECT_GUIDE.md` §15b and `skills/cl8y-site-positioning/invariants.md` document that this static SPA should send `X-Frame-Options: DENY` or `Content-Security-Policy: frame-ancestors 'none'`. `render.yaml` has no headers today. The marketing page must not become a frameable wallet/connect surface. This is host config on Render (and any CDN in front), not homepage copy. Related: leftover CEX rows in `src/data/links.ts` stay with **#2** (token directory). Do not remount retired homepage modules. ## Acceptance criteria - [ ] Production responses for `cl8y.com` (and preview if used) include `X-Frame-Options: DENY` and/or `Content-Security-Policy` with `frame-ancestors 'none'`. - [ ] `render.yaml` (or the Render dashboard equivalent) is the source of truth so a fresh deploy keeps the header. - [ ] No new frameable wallet-connect widget is introduced on the marketing site. - [ ] Document the live header in `PROJECT_GUIDE.md` once confirmed (curl -I against production). ## Test plan 1. `curl -sI https://cl8y.com` (and the Render URL) shows the header. 2. A simple iframe embed of `/` is blocked by the browser. 3. Redeploy from `main` and re-check so the header is not dashboard-only drift. ## Out of scope - Token directory / AscendEX purge (#2). - Deleting unmounted retired modules.

PlasticDigits commented

2026-08-25 07:00:11 +00:00

(Migrated from gitlab.com)

marked as related to #1

PlasticDigits commented

2026-08-25 07:00:16 +00:00

(Migrated from gitlab.com)

mentioned in issue #1

PlasticDigits commented

2026-08-25 07:20:24 +00:00

(Migrated from gitlab.com)

mentioned in merge request !9

PlasticDigits commented

2026-08-25 13:10:07 +00:00

(Migrated from gitlab.com)

mentioned in merge request !10

PlasticDigits commented

2026-08-25 13:10:15 +00:00

(Migrated from gitlab.com)

Clickjacking headers are included in !10 (render.yaml keeps blog rewrites). Production curl -sI confirmation is still needed after deploy.

Clickjacking headers are included in !10 (`render.yaml` keeps blog rewrites). Production `curl -sI` confirmation is still needed after deploy.

PlasticDigits commented

2026-08-25 13:31:57 +00:00

(Migrated from gitlab.com)

mentioned in issue #4

PlasticDigits commented

2026-08-26 01:11:52 +00:00

(Migrated from gitlab.com)

mentioned in commit b124356850

mentioned in commit b124356850453eecba3b28bc8bfe01ffdb06c578

PlasticDigits (Migrated from gitlab.com) closed this issue

2026-08-26 01:11:52 +00:00

PlasticDigits commented

2026-08-26 01:12:03 +00:00

(Migrated from gitlab.com)

mentioned in issue #2

PlasticDigits commented

2026-08-26 01:12:03 +00:00

(Migrated from gitlab.com)

Merge review (2026-08-26)

Clickjacking headers from !10 are now on GitLab main in render.yaml (X-Frame-Options: DENY and Content-Security-Policy: frame-ancestors 'none' on /*, blog rewrites kept). No wallet-connect widget was added.

Not yet done (needs a live deploy):

curl -sI https://cl8y.com today is nginx (last-modified: Mon, 22 Jun 2026) and does not send X-Frame-Options or frame-ancestors.
Issue AC “document the live header in PROJECT_GUIDE.md once confirmed” cannot be closed until that curl is green after deploy.

Opened a follow-up issue for the production confirmation + PROJECT_GUIDE note.

Merge review (2026-08-26) Clickjacking headers from !10 are now on GitLab `main` in `render.yaml` (`X-Frame-Options: DENY` and `Content-Security-Policy: frame-ancestors 'none'` on `/*`, blog rewrites kept). No wallet-connect widget was added. **Not yet done (needs a live deploy):** - `curl -sI https://cl8y.com` today is nginx (`last-modified: Mon, 22 Jun 2026`) and does **not** send `X-Frame-Options` or `frame-ancestors`. - Issue AC “document the live header in PROJECT_GUIDE.md once confirmed” cannot be closed until that curl is green after deploy. Opened a follow-up issue for the production confirmation + PROJECT_GUIDE note.

PlasticDigits commented

2026-08-26 01:12:11 +00:00

(Migrated from gitlab.com)

mentioned in issue #5

PlasticDigits commented

2026-08-26 01:12:11 +00:00

(Migrated from gitlab.com)

marked as related to #5

PlasticDigits commented

2026-08-31 05:34:26 +00:00

(Migrated from gitlab.com)

mentioned in issue #7

Rows
Columns

Set clickjacking headers on Render (X-Frame-Options / frame-ancestors) #3

Summary

Acceptance criteria

Test plan

Out of scope