search

credential-handler / credential-handler-polyfill

Credential Handler API polyfill
https://chapi.io
BSD 3-Clause "New" or "Revised" License
36 stars 13 forks source link

Add documentation for credential handlers about x-frame-options header #19

Closed dlongley closed 2 years ago

dlongley commented 3 years ago

Credential handlers should only be served with x-frame-options set to a value of the authn.io mediator -- this needs to be documented and added to demo handlers. I believe we used to have another issue for this somewhere but can't find it so refiling. This is to help mitigate click-jacking and serving credential handlers outside of the mediator.

dlongley commented 3 years ago

X-frame-options was deprecated in favor of CSP frame-ancestors.

dlongley commented 2 years ago

Closing this because it is no longer applicable.