Tria/edr-platform
1
0
Fork 0
mirror of https://github.com/Tria-plc/edr-platform.git synced 2026-08-27 00:52:50 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix: ( x-frame ): add X-Frame-Options: DENY anti-clickjacking header

Browse Source
This commit is contained in:
Abubeker Yasin
2026-07-05 22:46:20 +03:00
parent 0558b4187e
commit 6d9dc0f2a3
2 changed files with 6 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
apps/edr-passenger-web/backoffice/src/middleware.ts
View File

@@ -85,6 +85,9 @@ export function middleware(request: NextRequest) {
}
response.headers.set('Content-Security-Policy', csp);
// Anti-clickjacking. `frame-ancestors 'none'` (in the CSP above) is the modern control;
// X-Frame-Options: DENY is the legacy equivalent for older browsers and scanners.
response.headers.set('X-Frame-Options', 'DENY');
return response;
}

3
apps/edr-passenger-web/portal/src/middleware.ts
View File

@@ -108,6 +108,9 @@ export function middleware(request: NextRequest) {
}
response.headers.set('Content-Security-Policy', csp);
// Anti-clickjacking. `frame-ancestors 'none'` (in the CSP above) is the modern control;
// X-Frame-Options: DENY is the legacy equivalent for older browsers and scanners.
response.headers.set('X-Frame-Options', 'DENY');
return response;
}