search

haiwen / seafile-docker

A Docker image for Seafile server
Other
536 stars 180 forks source link

Set "X-Frame" Option in header to prevent Clickjacking attacks #384

Closed m-terlinde closed 3 months ago

m-terlinde commented 3 months ago

Dear team,

in the current deployment of 10.0.1 the X-Frame header option is not set at all. This reduces the security of the login page.

Is it possible to set the option for the reverse proxy?

Thanks, Matthias

freeplant commented 3 months ago

You can modify the generated Nginx configuration file according to your need after the first run of the docker image.

m-terlinde commented 3 months ago

Sure thing, but shouldn't Seafile be in a "secure-by-default" mode? It would be good to have that for every installation.

freeplant commented 3 months ago

Different people have different requirements. For example, some users need to embed a Seafile iframe in their own mobile apps. We don't want to break such use cases.