Selective route permission to use embeds, fixes #322 in a better way #812
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
rezonant
suggested changes
Jul 15, 2018
support/nginx/peertube
Outdated
| @@ -38,6 +38,8 @@ server { | |||
| # resolver_timeout 5s; | |||
|
|
|||
| add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload"; | |||
| add_header X-Frame-Options DENY; | |||
| add_header X-Frame-Options https://peertube.example.com/videos/embed; | |||
There was a problem hiding this comment.
If people forget to update this, the default position will be to deny embeds. I think the default should be to allow embeds. This header should be applied dynamically in the codebase not in the server configuration.
There was a problem hiding this comment.
Should be corrected.
rigelk
force-pushed
the
nginx/selective-frame-deny
branch
from
c24c18d
to
d3c5e5c
Compare
rezonant
suggested changes
Jul 16, 2018
server.ts
Outdated
| app.use('/services', servicesRouter, helmet.frameguard({ | ||
| action: 'allow-from', | ||
| domain: CONFIG.WEBSERVER.URL | ||
| })) |
There was a problem hiding this comment.
The regular HTML embed is served from /embed, this is the oembed part
rigelk
force-pushed
the
nginx/selective-frame-deny
branch
3 times, most recently
from
edcf5d6
to
e9a49a2
Compare
rigelk
added
the
Status: Requires Tests
rigelk
force-pushed
the
nginx/selective-frame-deny
branch
from
e9a49a2
to
be9520d
Compare
|
@rezonant I've added a CSP since helmet makes adding one quite easy. Could you have a look at it? |
anmol26s
pushed a commit
to YunoHost-Apps/peertube_ynh
that referenced
this pull request
Jul 17, 2018
rigelk
force-pushed
the
nginx/selective-frame-deny
branch
from
be9520d
to
8c3caec
Compare
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
note: this time it should work 馃槄