fix: set x-frame-options to deny (#3)

GoogleCloudPlatform · Dec 18, 2019 · 1a3ec1b · 1a3ec1b
1 parent d0da281
commit 1a3ec1b
Show file tree

Hide file tree

Showing 2 changed files with 3 additions and 1 deletion.
diff --git a/html/token-settings.html b/html/token-settings.html
@@ -70,4 +70,4 @@ <h3>Package specific publish token.</h3>
         }
         </script>
     </body>
-</html>
+</html>
diff --git a/src/server.ts b/src/server.ts
@@ -627,6 +627,7 @@ app.get('/_/token-settings', wrap(async (req, res) => {
           }
 
           res.header('content-type', 'text/html');
+          res.header('x-frame-options','deny');
           res.end(tokenSettingsPage);
         }));
 
@@ -647,6 +648,7 @@ app.get('/_/manage-tokens', wrap(async (req, res) => {
           let page = manageTokensPage + '';
           page = page.replace('{username}', req.session!.user.login);
 
+          res.header('x-frame-options','deny');
           res.header('content-type', 'text/html');
           res.end(page);
         }));