Skip to content

2.4.1-dh

2.4.1-dh: :bug: [DH#606] Update CSP frame-ancestors directive
@sergei-maertens sergei-maertens tagged this 28 Nov 15:47 
The configuration of CSP frame-ancestors conflicted with the X-Frame-
Options header configuration (set to DENY). We do not support using
frames of any kind (frame, iframe, object, embed) and thus
X_FRAME_OPTIONS is set to DENY. This results in the X-Frame-Options
HTTP response header, which is obsoleted by the Content Security
Policy frame-ancestors directive. The equivalent configuration to block
all frames is to set it to 'none' rather than 'self'.

For more context, see:

* https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/frame-ancestors
* https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/frame-ancestors

Backport-of: #3635
Assets 2
Loading