Security vulnerability: use X-Frame-Options header as default

manuel-serrano / hop

Multitier JavaScript

Other

142 stars 18 forks source link

Security vulnerability: use X-Frame-Options header as default #105

Open svenha opened 6 months ago

svenha commented 6 months ago

All Hop websites (without any special configuration) are vulnerable to click jacking (or UI redress attack). Can we please have a default http header? For example,

 X-Frame-Options: SAMEORIGIN

see https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Frame-Options

svenha commented 6 months ago

DENY is more secure than SAMEORIGIN. I opened a pull request: #106