search

zowe / explorer-ui-server

Simple HTTPS web server, used by explorer UI plugins
Eclipse Public License 2.0
0 stars 2 forks source link

Implement whitelist for X-Frame-Options (Embedding web page) #5

Closed jordanCain closed 5 years ago

jordanCain commented 5 years ago

We should whitelist the allowed embedders of any web application surfaced via the explorer server.

The X-Frame-Options header can be used to achieve this, see: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Frame-Options

Related: https://github.com/zowe/explorer-server/issues/28

jordanCain commented 5 years ago

Initial fix to restrict to same origin https://github.com/zowe/explorer-ui-server/pull/8/

jackjia-ibm commented 5 years ago

Related PR created: https://github.com/zowe/explorer-ui-server/pull/9

After this PR is merged, announce MINOR release to create version v0.1.0, then we can proceed with these PRs:

https://github.com/zowe/explorer-jes/pull/81 https://github.com/zowe/explorer-mvs/pull/61 https://github.com/zowe/explorer-uss/pull/45 https://github.com/zowe/zowe-install-packaging/pull/382

jackjia-ibm commented 5 years ago

All related PRs had been approved/merged. This issue can be closed now.