From 6d9dc0f2a3fd8087cf2bc6d41c7e184e9cac7668 Mon Sep 17 00:00:00 2001 From: Abubeker Yasin Date: Sun, 5 Jul 2026 22:46:20 +0300 Subject: [PATCH] fix: ( x-frame ): add X-Frame-Options: DENY anti-clickjacking header --- apps/edr-passenger-web/backoffice/src/middleware.ts | 3 +++ apps/edr-passenger-web/portal/src/middleware.ts | 3 +++ 2 files changed, 6 insertions(+) diff --git a/apps/edr-passenger-web/backoffice/src/middleware.ts b/apps/edr-passenger-web/backoffice/src/middleware.ts index d665aee3f..db7af8568 100644 --- a/apps/edr-passenger-web/backoffice/src/middleware.ts +++ b/apps/edr-passenger-web/backoffice/src/middleware.ts @@ -85,6 +85,9 @@ export function middleware(request: NextRequest) { } response.headers.set('Content-Security-Policy', csp); + // Anti-clickjacking. `frame-ancestors 'none'` (in the CSP above) is the modern control; + // X-Frame-Options: DENY is the legacy equivalent for older browsers and scanners. + response.headers.set('X-Frame-Options', 'DENY'); return response; } diff --git a/apps/edr-passenger-web/portal/src/middleware.ts b/apps/edr-passenger-web/portal/src/middleware.ts index fb1c27e84..c7960a601 100644 --- a/apps/edr-passenger-web/portal/src/middleware.ts +++ b/apps/edr-passenger-web/portal/src/middleware.ts @@ -108,6 +108,9 @@ export function middleware(request: NextRequest) { } response.headers.set('Content-Security-Policy', csp); + // Anti-clickjacking. `frame-ancestors 'none'` (in the CSP above) is the modern control; + // X-Frame-Options: DENY is the legacy equivalent for older browsers and scanners. + response.headers.set('X-Frame-Options', 'DENY'); return response; }