Krillion · the daily dive

Este jogo é seu?

Deixe ele jogável aqui mesmo no Gamesdle. Copie este prompt para o seu agente de programação com IA (Claude Code, Cursor, Copilot e afins) ou envie para quem cuida do site.

My web game at https://krillion.io/ needs to be playable inside an iframe on https://gamesdle.bid (a directory of daily games that embeds games in its page).

Right now the browser refuses to show it in a frame because the page is served with:
  X-Frame-Options: SAMEORIGIN
  Content-Security-Policy: ... frame-ancestors 'self' ...

Please make these changes, keeping everything else about the site the same:

1. Send this on every HTML response (merge it into the existing Content-Security-Policy if there is one; keep any other origins that are already allowed):
   Content-Security-Policy: frame-ancestors 'self' https://gamesdle.bid
2. Remove the X-Frame-Options header. It cannot allow one specific outside site, and frame-ancestors replaces it in all current browsers.
3. Find where headers are set. Common places: public/_headers (Cloudflare Pages, Netlify), vercel.json "headers", next.config.js headers(), nuxt/vite server config, nginx add_header, Apache Header set, Express/helmet (frameguard and contentSecurityPolicy.frameAncestors), a Cloudflare Worker or other edge function, or a CDN response-header rule.
4. Search the client code for frame-busting such as `if (top !== self) top.location = ...`, `window.top.location`, or code that hides the page when `window.self !== window.top`, and remove it or allow it to run when the parent is https://gamesdle.bid.
5. Inside a cross-site iframe, browsers may block or partition third-party cookies and storage. If saving progress or signing in depends on cookies, make sure the game still starts and plays without them (localStorage is fine; it is kept separately per embedding site).

When it is deployed, verify with:
  curl -sI https://krillion.io/ | grep -iE 'x-frame-options|content-security-policy'
The output should include frame-ancestors with https://gamesdle.bid and no X-Frame-Options DENY or SAMEORIGIN.