Confirm production clickjacking headers after deploy #5

New issue

PlasticDigits · 2026-08-26T01:12:11Z

PlasticDigits commented

2026-08-26 01:12:11 +00:00

(Migrated from gitlab.com)

Summary

!10 merged the Render clickjacking headers into main (render.yaml: X-Frame-Options: DENY and Content-Security-Policy: frame-ancestors 'none' on /*, blog prerender rewrites kept). GitLab #3 cannot be fully closed until production is redeployed and the live response is documented.

Pre-merge check (2026-08-26): curl -sI https://cl8y.com is nginx (last-modified: Mon, 22 Jun 2026) and does not send either header. cl8y.com may not yet be serving the current Render/main artifact.

Acceptance criteria

After deploy from current main, curl -sI https://cl8y.com shows X-Frame-Options: DENY and/or Content-Security-Policy containing frame-ancestors 'none'.
The same headers appear on the Render service URL if it is distinct from cl8y.com.
PROJECT_GUIDE.md §15b records that the live header was confirmed (date + curl snippet), not only that render.yaml declares it.
A simple iframe embed of / is blocked by the browser.

Out of scope

Token directory content (done in !10 / #2).
Changing host provider. If cl8y.com is still the June nginx box and not Render, that deploy-routing gap is in scope here only as “headers must be live on the public hostname.”

## Summary !10 merged the Render clickjacking headers into `main` (`render.yaml`: `X-Frame-Options: DENY` and `Content-Security-Policy: frame-ancestors 'none'` on `/*`, blog prerender rewrites kept). GitLab #3 cannot be fully closed until production is redeployed and the live response is documented. Pre-merge check (`2026-08-26`): `curl -sI https://cl8y.com` is nginx (`last-modified: Mon, 22 Jun 2026`) and does **not** send either header. cl8y.com may not yet be serving the current Render/`main` artifact. ## Acceptance criteria - [ ] After deploy from current `main`, `curl -sI https://cl8y.com` shows `X-Frame-Options: DENY` and/or `Content-Security-Policy` containing `frame-ancestors 'none'`. - [ ] The same headers appear on the Render service URL if it is distinct from cl8y.com. - [ ] `PROJECT_GUIDE.md` §15b records that the live header was confirmed (date + curl snippet), not only that `render.yaml` declares it. - [ ] A simple iframe embed of `/` is blocked by the browser. ## Out of scope - Token directory content (done in !10 / #2). - Changing host provider. If cl8y.com is still the June nginx box and not Render, that deploy-routing gap is in scope here only as “headers must be live on the public hostname.”

PlasticDigits commented

2026-08-26 01:12:11 +00:00

(Migrated from gitlab.com)

marked as related to #3

PlasticDigits referenced this issue

2026-09-05 15:53:55 +00:00

fix(frontend): stop SPA fallthrough on /privacy, /cookies, /opt-out #12

ops-worker added the

agent:implement

ready

labels

2026-09-05 19:23:37 +00:00