Avoid potential click jacking (#190)

inbucket · Nov 19, 2020 · 3c5960a · 3c5960a
1 parent 7f430f2
commit 3c5960a
Showing 1 changed file with 2 additions and 0 deletions.
diff --git a/pkg/server/web/handlers.go b/pkg/server/web/handlers.go
@@ -94,6 +94,8 @@ func spaTemplateHandler(tmpl *template.Template, basePath string,
 		BasePath: basePath,
 	}
 	return http.HandlerFunc(func(w http.ResponseWriter, req *http.Request) {
+		// ensure we do now allow click jacking
+		w.Header().Set("X-Frame-Options", "SameOrigin")
 		err := tmpl.Execute(w, tmplData)
 		if err != nil {
 			log.Error().Str("module", "web").Str("remote", req.RemoteAddr).Str("proto", req.Proto).