school_compare/.playwright-mcp/console-2026-07-15T06-33-39-102Z.log at feat/allow-analytics-iframe-embed - school_compare - Private Repo

tudor/school_compare

Files

T

TudorandClaude Opus 4.8 9556595800

PR Checks / Frontend Typecheck + Tests (pull_request) Successful in 1m2s

Details

PR Checks / Backend Smoke (pull_request) Successful in 7s

Details

PR Checks / Build Backend (no push) (pull_request) Successful in 11s

Details

PR Checks / Build Frontend (no push) (pull_request) Successful in 48s

Details

PR Checks / Build Pipeline (no push) (pull_request) Successful in 10s

Details

PR Checks / AI Code Review (Claude) (pull_request) Successful in 8s

Details

feat(security): allow analytics subdomain to iframe the site

Replace X-Frame-Options: SAMEORIGIN with a CSP frame-ancestors directive
so analytics.schoolcompare.co.uk (Umami heatmap/recorder) can embed the
site while all other origins stay blocked. X-Frame-Options cannot allow a
specific sibling subdomain (ALLOW-FROM is deprecated/ignored by modern
browsers), so frame-ancestors is the correct replacement.

Also update the nginx snippet in DEPLOYMENT.md to match, so the reverse
proxy doesn't re-inject a conflicting X-Frame-Options header.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

2026-07-21 22:50:44 +01:00

2 lines

143 B

Plaintext

Raw Permalink Blame History

[ 37ms] [ERROR] Failed to load resource: the server responded with a status of 404 (File not found) @ http://localhost:8493/favicon.ico:0