Uploaded image for project: 'OFBiz'
  1. OFBiz
  2. OFBIZ-9891

X-Frame-Options configuration is not working

Agile BoardAttach filesAttach ScreenshotVotersWatch issueWatchersCreate sub-taskLinkCloneUpdate Comment AuthorReplace String in CommentUpdate Comment VisibilityDelete Comments
    XMLWordPrintableJSON

Details

    • Bug
    • Status: Closed
    • Major
    • Resolution: Fixed
    • Trunk
    • 17.12.01
    • framework
    • None

    Description

      The configuration attribute in the controller/site-conf.xsd is "x-frame-option" while the Controller reads "x-frame-options".

      I will change this to be "x-frame-options" in controller/site-conf.xsd also because the Header value is "X-Frame-Options".

      I also propose to introduce another configuration token "none" to be able to switch off this header value for the view, same mechanism as for strict-transport-security.

      What do you think?

      Attachments

        Activity

          This comment will be Viewable by All Users Viewable by All Users
          Cancel

          People

            mbrohl Michael Brohl
            mbrohl Michael Brohl
            Votes:
            1 Vote for this issue
            Watchers:
            2 Start watching this issue

            Dates

              Created:
              Updated:
              Resolved:

              Slack

                Issue deployment