# Docker PENPOT_FRONTEND_FLAGS
enable-cors

# NGINX
# Remove any existing:
# add_header X-Frame-Options SAMEORIGIN;

# If the upstream app sends X-Frame-Options:
proxy_hide_header X-Frame-Options;
add_header Content-Security-Policy "frame-ancestors 'self' https://your-parent-domain.com" always;