Set X-Frame-Options: SAMEORIGIN to protect against frame-related vuln…

…erability
apache · Sep 14, 2015 · 70da85b · 70da85b
1 parent d815654
commit 70da85b
Showing 1 changed file with 2 additions and 0 deletions.
diff --git a/core/src/main/scala/org/apache/spark/ui/JettyUtils.scala b/core/src/main/scala/org/apache/spark/ui/JettyUtils.scala
@@ -68,6 +68,8 @@ private[spark] object JettyUtils extends Logging {
             response.setStatus(HttpServletResponse.SC_OK)
             val result = servletParams.responder(request)
             response.setHeader("Cache-Control", "no-cache, no-store, must-revalidate")
+            // SPARK-10589 avoid frame-related click-jacking vulnerability
+            response.setHeader("X-Frame-Options", "SAMEORIGIN")
             // scalastyle:off println
             response.getWriter.println(servletParams.extractFn(result))
             // scalastyle:on println