search

whatwg / misc-server

Miscellaneous resources for the servers hosting *.whatwg.org domains
Other
22 stars 16 forks source link

Test X-Frame-Options header for blog and wiki #110

Closed foolip closed 4 years ago

foolip commented 4 years ago

The actual fix isn't tracked by version control, it is to add Header always set X-Frame-Options: "sameorigin" to /etc/apache2/conf-enabled/zz_local.conf on multicol.

Fixes https://github.com/whatwg/misc-server/issues/108.

foolip commented 4 years ago

I've already tested this live and reverted. I'll enable it live again right before I merge this.

foolip commented 4 years ago

Deployed and passing tests on master.

domenic commented 4 years ago

I remain sad about how portions of our server setup are not in version control.

annevk commented 4 years ago

@domenic are we tracking that somewhere, at least?

foolip commented 4 years ago

It isn't tracked anywhere, filed https://github.com/whatwg/misc-server/issues/112. Unfortunately, the only way of having any confidence that a setup would work is by setting it up from scratch. And since it includes a database, that data wouldn't be tracked anywhere except in VM backups.

To reduce the maintenance by a lot, we'd need to use a managed database solution and put the blog+wiki setup in a Dockerfile, or transition both to something that requires only static hosting. But for the latter I have low confidence that any existing tools would convert markup with enough fidelity, so the bulk of the work would be in verifying the transition, not in making it.