Bug 475894 - Send the 'X-Frame-Options: SAMEORIGIN' header to help protect against clickjacking.

[r=mkanat a=mkanat]

Bug 475894 - Send the 'X-Frame-Options: SAMEORIGIN' header to help protect against clickjacking.
c9c81ee7 · Reed Loden · 374ee5c8 · c9c81ee7
Commit c9c81ee7 authored Dec 18, 2010 by Reed Loden
Hide whitespace changes
Inline Side-by-side

Showing with 6 additions and 0 deletions

CGI.pm Bugzilla/CGI.pm +6 -0

No files found.
--- a/Bugzilla/CGI.pm
+++ b/Bugzilla/CGI.pm
@@ -287,6 +287,12 @@ sub header {
        unshift(@_, '-strict_transport_security' => $sts_opts);
    }

+    # Add X-Frame-Options header to prevent framing and subsequent
+    # possible clickjacking problems.
+    unless ($self->url_is_attachment_base) {
+        unshift(@_, '-x_frame_options' => 'SAMEORIGIN');
+    }
+
    return $self->SUPER::header(@_) || "";
 }