Covering a few extra cases for preventing clickjacking attacks. (#2309)

uc-cdis · Aug 7, 2023 · 92f8f3e · 92f8f3e
1 parent c4d01f0
commit 92f8f3e
Show file tree

Hide file tree

Showing 3 changed files with 11 additions and 0 deletions.
diff --git a/kube/services/revproxy/gen3.nginx.conf/gen3ff-as-root/frontend-framework-service.conf b/kube/services/revproxy/gen3.nginx.conf/gen3ff-as-root/frontend-framework-service.conf
@@ -2,6 +2,10 @@
               if ($csrf_check !~ ^ok-\S.+$) {
                 return 403 "failed csrf check";
               }             
+
+              # added to avoid click-jacking attacks
+              add_header X-Frame-Options "SAMEORIGIN";
+
               set $proxy_service  "frontend-framework";
               set $upstream http://frontend-framework-service.$namespace.svc.cluster.local;
               proxy_pass $upstream;

diff --git a/kube/services/revproxy/gen3.nginx.conf/gen3ff-as-root/portal-service.conf b/kube/services/revproxy/gen3.nginx.conf/gen3ff-as-root/portal-service.conf
@@ -21,5 +21,8 @@
                 rewrite ^/(.*)$ /dashboard/Public/maintenance-page/index.html redirect;
               }
 
+              # added to avoid click-jacking attacks
+              add_header X-Frame-Options "SAMEORIGIN";
+
               proxy_pass $upstream;
           }
diff --git a/kube/services/revproxy/gen3.nginx.conf/portal-as-root/frontend-framework-service.conf b/kube/services/revproxy/gen3.nginx.conf/portal-as-root/frontend-framework-service.conf
@@ -6,6 +6,10 @@
               if ($csrf_check !~ ^ok-\S.+$) {
                 return 403 "failed csrf check";
               }             
+
+              # added to avoid click-jacking attacks
+              add_header X-Frame-Options "SAMEORIGIN";
+
               set $proxy_service  "frontend-framework";
               # frontend framework service expects the /ff/ prefix, so no path rewrite
               set $upstream http://frontend-framework-service.$namespace.svc.cluster.local;