App must set security headers to protect against clickjacking.

[filipembcruz]

Hi everyone,

Someone knows how I solve this? Where Can I put this configuration?

Requirements that must be met before initial screening
App must set security headers to protect against clickjacking.
Your app must set the proper frame-ancestors content security policy directive to avoid clickjacking attacks. The 'content-security-policy' header should set frame ancestor to frame-ancestors https://cambridgetestshop.myshopify.com https://admin.shopify.com.

More information here

[filipembcruz]

The solution is put the code below above your app.blade.php html (or any layout base)

<?php
  header("Content-Security-Policy: frame-ancestors https://".auth()->user()->name);
?>

[haseebbutt1999]

<?php
  header("Content-Security-Policy: frame-ancestors https://".auth()->user()->name) https://admin.shopify.com;
?>

Also "https://admin.shopify.com" need to be attach in header, other wise it will not work !

[devRonak]

@filipembcruz Where do I have to enter this code? I got this error when I was submitting my app to Shopify. How do I check if I have fixed this error after placing this code, before resubmitting the app in Shopify? This is the error given by Shopify. error

[filipembcruz]

@devRonak you problem is probably different from the above. Maybe you should change your authentication route on Shopify partners configuration.