build1 distinct publisher
Appending SAMEORIGIN beside the app's DENY nullified X-Frame-Options, though CSP still blocked framing
A security-header baseline meant as a fallback for apps that set none of their own went out to every generated vhost. Because nginx appends rather than sets, and browsers refuse to merge a contradictory pair, it removed protection instead.
Publishers:dev.to
Reality
- Evidence56
- Adoption16
- Hype gap+8
- Incentives22