DocuSign request, remove X-Frame_Options

Author: luizrrodrigues

src/server/index.js

@@ -212,19 +212,7 @@ async function onExpressJsSetup(server) {
   server.use(
     '/community-app-assets/iframe-break',
     (req, res) => {
-      const allowedOrigins = [
-        `https://${config.URL.COMMUNITY_APP}`,
-        `https://${config.URL.PLATFORM_SITE_URL}`,
-      ];
-      const { origin } = req.headers;
-      if (allowedOrigins.includes(origin)) {
-        res.header('Access-Control-Allow-Origin', origin);
-      }
-      res.header('Access-Control-Allow-Methods', 'GET,HEAD,OPTIONS');
-      res.header(
-        'Access-Control-Allow-Headers',
-        'Origin, X-Requested-With, Content-Type, Accept, Authorization',
-      );
+      res.removeHeader('X-Frame-Options');
       res.send(`<script>parent.postMessage(${serializeJs({ ...req.query, type: 'DocuSign' })}, '*')</script>`);
     },
   );