neptune/ghost-portal
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add security headers to disallow iframe embedding (#11632)

Browse Source 
* fix: add security headers to devServer configuration

* fix: update nginx configuration to enhance security headers
This commit is contained in:
Arjun Porwal 2025-06-18 18:51:46 +05:30 committed by GitHub
parent 0e43162c6d
commit 0de38471db
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
3 changed files with 7 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

0
docker/build.sh Normal file → Executable file
View File

3
docker/nginx.conf
View File

@ -12,6 +12,9 @@ http {
include /etc/nginx/mime.types; include /etc/nginx/mime.types;
default_type application/octet-stream; default_type application/octet-stream;
add_header X-Frame-Options "DENY" always;
add_header Content-Security-Policy "frame-ancestors 'none'" always;
log_format main '$remote_addr - $remote_user [$time_local] "$request" ' log_format main '$remote_addr - $remote_user [$time_local] "$request" '
'$status $body_bytes_sent "$http_referer" ' '$status $body_bytes_sent "$http_referer" '
'"$http_user_agent" "$http_x_forwarded_for"'; '"$http_user_agent" "$http_x_forwarded_for"';

4
packages/apps/webpack.serve.cjs
View File

@ -11,6 +11,10 @@ module.exports = merge(
baseConfig(__dirname, 'development'), baseConfig(__dirname, 'development'),
{ {
devServer: { devServer: {
headers: {
'Content-Security-Policy': "frame-ancestors 'none'",
'X-Frame-Options': 'DENY'
},
hot: true, hot: true,
open: false, open: false,
port: 3000, port: 3000,