From c72b26de8d156aa9650ca03a431d6ff17951ccec Mon Sep 17 00:00:00 2001
From: George Cushen <gcushen@users.noreply.github.com>
Date: Mon, 15 Dec 2025 00:13:47 +0000
Subject: [PATCH] feat: allow same origin iframes to support slides

---
 modules/blox-plugin-netlify/src/layouts/index.headers | 11 ++++++++---
 templates/academic-cv/config/_default/params.yaml     |  2 +-
 2 files changed, 9 insertions(+), 4 deletions(-)

diff --git a/modules/blox-plugin-netlify/src/layouts/index.headers b/modules/blox-plugin-netlify/src/layouts/index.headers
index 26ac457c..56eccda8 100644
--- a/modules/blox-plugin-netlify/src/layouts/index.headers
+++ b/modules/blox-plugin-netlify/src/layouts/index.headers
@@ -1,14 +1,19 @@
 {{- $csp_policy := site.Params.hugoblox.security.csp.policy | default "" -}}
 {{- $csp_report_only := site.Params.hugoblox.security.csp.report_only | default false -}}
-{{- $frame_options := site.Params.hugoblox.security.frame_options | default "deny" -}}
-{{- $allow_frame := eq $frame_options "allow" -}}
+{{- $frame_options := site.Params.hugoblox.security.frame_options | default "sameorigin" -}}
 {{- $default_perms := "accelerometer=(), camera=(), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), payment=(), usb=()" -}}
 {{- $permissions_policy := site.Params.hugoblox.security.permissions_policy | default $default_perms -}}
 # Netlify headers
 # Automatically generated
 # Documentation: https://docs.hugoblox.com/hugo-tutorials/security/
 /*
-  {{if not $allow_frame}}X-Frame-Options: DENY{{end}}
+  {{- if eq $frame_options "allow" -}}
+    {{/* No X-Frame-Options header - allows all origins */}}
+  {{- else if eq $frame_options "sameorigin" -}}
+  X-Frame-Options: SAMEORIGIN
+  {{- else -}}
+  X-Frame-Options: DENY
+  {{- end -}}
   X-XSS-Protection: 1; mode=block
   X-Content-Type-Options: nosniff
   Strict-Transport-Security: max-age=31536000; includeSubDomains
diff --git a/templates/academic-cv/config/_default/params.yaml b/templates/academic-cv/config/_default/params.yaml
index 1e1bdffd..92273145 100644
--- a/templates/academic-cv/config/_default/params.yaml
+++ b/templates/academic-cv/config/_default/params.yaml
@@ -253,7 +253,7 @@ hugoblox:
     csp:
       policy: ""
       report_only: false
-    frame_options: deny                 # deny | sameorigin | allow
+    frame_options: sameorigin           # deny | sameorigin | allow - sameorigin allows slides embedding
     permissions_policy: ""
 
   # ────────────────────────────────────────────────────────────────────────────