search

eclipse / dirigible

Eclipse Dirigible™ Project
https://www.dirigible.io
Eclipse Public License 2.0
267 stars 88 forks source link

[Security] Clickjacking #397

Open ThuF opened 5 years ago

ThuF commented 5 years ago

Prevent clickjacking on productive instances

ThuF commented 5 years ago

So far DIRIGIBLE_PRODUCTIVE_IFRAME_ENABLED environment variable was introduced, but more comprehensive solution should be implied. For example all runtime releases should be clickjacking protected by default. However the simplest approach, to set this variable by default, doesn't work, as it also prevents IDE views and generated applications views (based on AngularJS template) from loading.