135/netdisco
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

clickjacking prevention via X-Frame-Options and Content-Security-Policy headers

Browse Source
This commit is contained in:
Oliver Gorwits
2021-10-06 16:44:36 +01:00
parent 726e8c611a
commit 381f412df9
3 changed files with 10 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
Build.PL
View File

@@ -71,6 +71,7 @@ Module::Build->new(
'Plack::Handler::Twiggy' => '0', 'Plack::Handler::Twiggy' => '0',
'Plack::Middleware::Debug' => '0', 'Plack::Middleware::Debug' => '0',
'Plack::Middleware::Expires' => '0.03', 'Plack::Middleware::Expires' => '0.03',
'Plack::Middleware::Headers' => '0',
'Plack::Middleware::ReverseProxy' => '0.15', 'Plack::Middleware::ReverseProxy' => '0.15',
'Pod::Usage' => 0, 'Pod::Usage' => 0,
'Regexp::Common' => 2017060201, 'Regexp::Common' => 2017060201,

6
bin/netdisco-web-fg
View File

@@ -31,6 +31,12 @@ BEGIN {
set plack_middlewares => [ set plack_middlewares => [
['Plack::Middleware::ReverseProxy'], ['Plack::Middleware::ReverseProxy'],
[ Headers => (
set => ['X-Frame-Options' => setting('HTTP-Header-X-Frame-Options')],
)],
[ Headers => (
set => ['Content-Security-Policy' => setting('HTTP-Header-Content-Security-Policy')],
)],
[ Expires => ( [ Expires => (
content_type => [qr{^application/javascript}, qr{^text/css}, qr{image}, qr{font}], content_type => [qr{^application/javascript}, qr{^text/css}, qr{image}, qr{font}],
expires => 'access plus 1 day', expires => 'access plus 1 day',

3
share/config.yml
View File

@@ -533,3 +533,6 @@ template: 'netdisco_template_toolkit'
route_cache: true route_cache: true
appname: 'Netdisco' appname: 'Netdisco'
behind_proxy: false behind_proxy: false
HTTP-Header-X-Frame-Options: 'DENY'
HTTP-Header-Content-Security-Policy: 'none'