michael/merlyn
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Prevent i-framing of frontend UI to prevent unsafe embedding and/or clickjacking (#1200)

Browse Source 
Prevent iframing of frontend UI to prevent unsafe embedding and/or clickjacking
This commit is contained in:
Timothy Carambat 2024-05-01 13:02:08 -07:00 committed by GitHub
parent 42e1d8e8ce
commit e61dfd80a5
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
1 changed files with 8 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
server/index.js
View File

@ -56,7 +56,14 @@ embeddedEndpoints(apiRouter);
if (process.env.NODE_ENV !== "development") {
app.use(
express.static(path.resolve(__dirname, "public"), { extensions: ["js"] })
express.static(path.resolve(__dirname, "public"), {
extensions: ["js"],
setHeaders: (res) => {
// Disable I-framing of entire site UI
res.removeHeader("X-Powered-By");
res.setHeader("X-Frame-Options", "DENY");
},
})
);
app.use("/", function (_, response) {