Can't set iframe headers using gatsby-plugin-netlify (gatsby 2)

[erikdstock]

[email protected]
[email protected]

Hi folks- i've been banging my head against the wall on this for a calendar website built using gatsby. We are trying to allow a new /embed route to display this calendar in another website's iframe, but those headers aren't being set. I've verified that this isn't working by looking at the /public/_headers file when building, as well as by deploying it and seeing that the iframe from our embedding site is failing to load the document.

Our gatsby config looks like this:

    {
      resolve: "gatsby-plugin-netlify",
      options: {
        mergeSecurityHeaders: false,
        headers: {
          "/embed": [
            "Content-Security-Policy: frame-ancestors 'self' https://*.myembeddingsite.com",
            "X-Frame-Options: ALLOW-FROM https://www.myembeddingsite.com",
          ],
        },
        // an approach taken from one of many questions on this topic
        // transformHeaders: (headers, path) => {
        //   // Strip out predefined X-Frame-Options: DENY-header
        //   console.warn("testing " + path)
        //   if (path === "/embed") {
        //     console.warn(headers)
        //   }
        //   return (path === "/*")
        //     ? headers.filter(h =>
        //         (h.split(": ")[1].includes("DENY"))
        //           ? (Boolean(console.warn("STRIPPING " + h)) || false)
        //           : true
        //       )
        //     : headers
        // },
      },
    },