Embeddable form as a nuxt middleware

app/Http/Kernel.php

@@ -4,7 +4,6 @@ namespace App\Http;
 
 use App\Http\Middleware\AuthenticateJWT;
 use App\Http\Middleware\CustomDomainRestriction;
-use App\Http\Middleware\EmbeddableForms;
 use App\Http\Middleware\IsAdmin;
 use App\Http\Middleware\IsNotSubscribed;
 use App\Http\Middleware\IsSubscribed;
@@ -46,12 +45,10 @@ class Kernel extends HttpKernel
             \Illuminate\View\Middleware\ShareErrorsFromSession::class,
             \App\Http\Middleware\VerifyCsrfToken::class,
             \Illuminate\Routing\Middleware\SubstituteBindings::class,
-            EmbeddableForms::class
         ],
 
         'spa' => [
             \Illuminate\Routing\Middleware\SubstituteBindings::class,
-            EmbeddableForms::class
         ],
 
         'api' => [

app/Http/Middleware/EmbeddableForms.php

@@ -1,36 +0,0 @@
-<?php
-
-namespace App\Http\Middleware;
-
-use Closure;
-use Illuminate\Http\Response;
-
-class EmbeddableForms
-{
-    /**
-     * Handle an incoming request.
-     *
-     * @param  \Illuminate\Http\Request  $request
-     * @param  \Closure  $next
-     *
-     * @return mixed
-     */
-    public function handle($request, Closure $next)
-    {
-        if ($request->expectsJson() || $request->wantsJson()) {
-            return $next($request);
-        }
-
-        $response = $next($request);
-
-        if (!str_starts_with($request->url(), url('/forms/'))) {
-            if ($response instanceof Response) {
-                $response->header('X-Frame-Options', 'SAMEORIGIN');
-            } elseif ($response instanceof \Symfony\Component\HttpFoundation\Response) {
-                $response->headers->set('X-Frame-Options', 'SAMEORIGIN');
-            }
-        }
-
-        return $response;
-    }
-}

client/server/plugins/embeddable.js

@@ -0,0 +1,9 @@
+export default defineNitroPlugin(nitroApp => {
+  nitroApp.hooks.hook('render:response', (response, { event }) => {
+    const routePath= event.context.params._
+    if (!routePath.startsWith('forms/')) {
+      // Only allow embedding of forms
+      response.headers['X-Frame-Options'] = 'sameorigin'
+    }
+  })
+})