diff options
| author | Christopher Speller <crspeller@gmail.com> | 2015-07-28 10:03:10 -0400 |
|---|---|---|
| committer | Christopher Speller <crspeller@gmail.com> | 2015-07-28 10:03:10 -0400 |
| commit | ec2e61bc55aa12c4157937ed6492e109ad3422ae (patch) | |
| tree | 39d59e2233349a98208c246c9acb878955af6a78 /api | |
| parent | 94b905aff5470dbe18037f7ee5e883b51bf228fd (diff) | |
| parent | ce2cf5b4e8c8fbd5df203787f94b781a95066057 (diff) | |
| download | chat-ec2e61bc55aa12c4157937ed6492e109ad3422ae.tar.gz chat-ec2e61bc55aa12c4157937ed6492e109ad3422ae.tar.bz2 chat-ec2e61bc55aa12c4157937ed6492e109ad3422ae.zip | |
Merge pull request #253 from nickago/MM-1654
MM-1654 Anti-clickjacking measures
Diffstat (limited to 'api')
| -rw-r--r-- | api/context.go | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/api/context.go b/api/context.go index ac9dffcbc..16da0a6eb 100644 --- a/api/context.go +++ b/api/context.go @@ -101,6 +101,12 @@ func (h handler) ServeHTTP(w http.ResponseWriter, r *http.Request) { w.Header().Set(model.HEADER_REQUEST_ID, c.RequestId) w.Header().Set(model.HEADER_VERSION_ID, utils.Cfg.ServiceSettings.Version) + // Instruct the browser not to display us in an iframe for anti-clickjacking + if !h.isApi { + w.Header().Set("X-Frame-Options", "DENY") + w.Header().Set("Content-Security-Policy", "frame-ancestors none") + } + sessionId := "" // attempt to parse the session token from the header |