[ZEPPELIN-3714] Add header option for Content-Security-Policy

• Type: Bug
• Status: Open
• Priority: Critical
• Resolution: Unresolved
• Affects Version/s: 0.7.3
• Fix Version/s: 0.9.0
• Component/s: conf
• Flags: Important
• Assignee: Unassigned
• Reporter: Dennis Thompson
• Created: 14/Aug/18 20:56
• Updated: 23/Jan/19 02:39

Description

Chrome doesn't support ALLOWED-FROM on X-Frame-Origins header which can cause troubles when Zeppelin is embedded in an app as an iframe. Adding this as an option solves the problem for allowed origins on Chrome, but will also not interferer with IE/Edge support.

^{Source: https://www.keycdn.com/blog/x-frame-options/#3-ALLOW-FROM-uriDirective}

Issue Links

• links to: GitHub Pull Request #3141