#sameorigin

[10basetom]

Prevent cross-domain hacks

Set "X-Frame-Options" to "SAMEORIGIN" or "DENY" in your server's HTTP header to prevent cross-domain hacks such as somebody else embedding your site in an iframe without your permission.

[hairyio]

Deploying linked web apps to Dokku using an extra nginx config file.

In the last post I detailed how to setup Dokku and Nginx with CORS. This time round I shall be showing a simple way to get 2 Dokku applications serving content under the same origin.

All you need to do is created an nginx config inside a subfolder of the dokku home directory (I created mine at /home/dokku/linkapp/nginx.conf) and point this at the named upstreams from the other config files (e.g. app1/nginx.conf, app2/nginx.conf). 

This has the side effect that nginx will fall over if you remove either of the apps but apart from that you should be fine.