yv01p/Umbraco-CMS
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Set fixed value for click-jacking protection to sameorigin instead of deny

Browse Source
This commit is contained in:
AndyButland
2016-06-13 20:48:37 +02:00
parent 203e9e3394
commit 0a00be7cfe
3 changed files with 6 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
src/Umbraco.Web/HealthCheck/Checks/Security/ClickJackingCheck.cs
View File

@@ -23,6 +23,7 @@ namespace Umbraco.Web.HealthCheck.Checks.Security
private const string SetFrameOptionsHeaderInConfigActiobn = "setFrameOptionsHeaderInConfig";
private const string XFrameOptionsHeader = "X-Frame-Options";
private const string XFrameOptionsValue = "sameorigin"; // Note can't use "deny" as that would prevent Umbraco itself using IFRAMEs
public ClickJackingCheck(HealthCheckContext healthCheckContext) : base(healthCheckContext)
{
@@ -194,7 +195,7 @@ namespace Umbraco.Web.HealthCheck.Checks.Security
{
addHeaderElement = new XElement("add");
addHeaderElement.Add(new XAttribute("name", XFrameOptionsHeader));
addHeaderElement.Add(new XAttribute("value", "deny"));
addHeaderElement.Add(new XAttribute("value", XFrameOptionsValue));
customHeadersElement.Add(addHeaderElement);
}