Drupal
/
drupal
mirror of https://git.drupalcode.org/project/drupal.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

Issue #2514136 by pwolanin, Fabianx: Add default clickjacking defense to core

8.0.x
webchick 2015-07-02 00:23:35 -07:00
parent 2710ccd026
commit c8a0c7c9c9
2 changed files with 2 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
core/lib/Drupal/Core/EventSubscriber/FinishResponseSubscriber.php
View File

@ -113,6 +113,7 @@ class FinishResponseSubscriber implements EventSubscriberInterface {
// XSS and other vulnerabilities.
// https://www.owasp.org/index.php/List_of_useful_HTTP_headers
$response->headers->set('X-Content-Type-Options', 'nosniff', FALSE);
$response->headers->set('X-Frame-Options', 'SAMEORIGIN', FALSE);
// Expose the cache contexts and cache tags associated with this page in a
// X-Drupal-Cache-Contexts and X-Drupal-Cache-Tags header respectively.

2
core/modules/system/src/Tests/Routing/RouterTest.php
View File

@ -40,7 +40,7 @@ class RouterTest extends WebTestBase {
$this->assertEqual($headers['x-ua-compatible'], 'IE=edge');
$this->assertEqual($headers['content-language'], 'en');
$this->assertEqual($headers['x-content-type-options'], 'nosniff');
$this->assertEqual($headers['x-frame-options'], 'SAMEORIGIN');
$this->drupalGet('router_test/test2');
$this->assertRaw('test2', 'The correct string was returned because the route was successful.');