{"action":"created","issue":{"url":"https://api.github.com/repos/sinatra/rack-protection/issues/95","labels_url":"https://api.github.com/repos/sinatra/rack-protection/issues/95/labels{/name}","comments_url":"https://api.github.com/repos/sinatra/rack-protection/issues/95/comments","events_url":"https://api.github.com/repos/sinatra/rack-protection/issues/95/events","html_url":"https://github.com/sinatra/rack-protection/pull/95","id":73455539,"number":95,"title":"Adds ability to allow or deny being embedded based on the referrer domain","user":{"login":"joaomilho","id":308196,"avatar_url":"https://avatars.githubusercontent.com/u/308196?v=3","gravatar_id":"","url":"https://api.github.com/users/joaomilho","html_url":"https://github.com/joaomilho","followers_url":"https://api.github.com/users/joaomilho/followers","following_url":"https://api.github.com/users/joaomilho/following{/other_user}","gists_url":"https://api.github.com/users/joaomilho/gists{/gist_id}","starred_url":"https://api.github.com/users/joaomilho/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/joaomilho/subscriptions","organizations_url":"https://api.github.com/users/joaomilho/orgs","repos_url":"https://api.github.com/users/joaomilho/repos","events_url":"https://api.github.com/users/joaomilho/events{/privacy}","received_events_url":"https://api.github.com/users/joaomilho/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":2,"created_at":"2015-05-05T22:50:52Z","updated_at":"2015-05-06T12:21:55Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/sinatra/rack-protection/pulls/95","html_url":"https://github.com/sinatra/rack-protection/pull/95","diff_url":"https://github.com/sinatra/rack-protection/pull/95.diff","patch_url":"https://github.com/sinatra/rack-protection/pull/95.patch"},"body":"Since `ALLOW-FROM` doesn't work properly on Chrome (and I heard Firefox), we need to be able to allow or deny being embedded based on the referrer domain. This PR adds this ability, and this is the interface of usage:\r\n\r\n``` ruby\r\nuse Rack::Protection::FrameOptions, allow_if: ->(domain){\r\n  domain == 'google.com'\r\n}\r\n```\r\n\r\nThis would allow the page to be on an iframe on google.com, and nowhere else.\r\n\r\nWDYT?\r\n"},"comment":{"url":"https://api.github.com/repos/sinatra/rack-protection/issues/comments/99428646","html_url":"https://github.com/sinatra/rack-protection/pull/95#issuecomment-99428646","issue_url":"https://api.github.com/repos/sinatra/rack-protection/issues/95","id":99428646,"user":{"login":"joaomilho","id":308196,"avatar_url":"https://avatars.githubusercontent.com/u/308196?v=3","gravatar_id":"","url":"https://api.github.com/users/joaomilho","html_url":"https://github.com/joaomilho","followers_url":"https://api.github.com/users/joaomilho/followers","following_url":"https://api.github.com/users/joaomilho/following{/other_user}","gists_url":"https://api.github.com/users/joaomilho/gists{/gist_id}","starred_url":"https://api.github.com/users/joaomilho/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/joaomilho/subscriptions","organizations_url":"https://api.github.com/users/joaomilho/orgs","repos_url":"https://api.github.com/users/joaomilho/repos","events_url":"https://api.github.com/users/joaomilho/events{/privacy}","received_events_url":"https://api.github.com/users/joaomilho/received_events","type":"User","site_admin":false},"created_at":"2015-05-06T12:21:55Z","updated_at":"2015-05-06T12:21:55Z","body":"All is well! :D"}}