Added decorator exclude_xframe_options_header

[jkfran]

Done

• Added decorator exclude_xframe_options_header to avoid the security header X-Frame-Options with the value SAMEORIGIN

QA

QA this change with canonical/snapcraft.io#3337

[nottrobin]

So the interface for using this feature is:

@exclude_xframe_options_header
def my_view():
    # ...

Another option would be something like:

def my_view():
    # ...
    response = flask.render_template("template")
    response.headers["x-frame-options"] = "allowall"
    return response

And then we would write the after_request function to only define x-frame-options if it didn't already exist. This feels a little more intuitive to me, but it has the downside that allowall is in fact not a valid option for x-frame-options - it only works because setting x-frame-options to an invalid option will cause browsers to simply ignore the header, which has the same effect.

So I can't quite decide what is best here.

[jkfran]

Another option would be something like:

def my_view():
    # ...
    response = flask.render_template("template")
    response.headers["x-frame-options"] = "allowall"
    return response

This was my first choice until I searched what is the default value for x-frame-options and discovering that there isn't and the header shouldn't be set then. I don't like setting an invalid value just to avoid the issue, I like the decorator, I'm also open to new ideas.

As an improvement of the current change, we can mix these two options so if we need to set the values DENY or ALLOW-FROM ... this decorator is not needed because the header is already defined.

[nottrobin]

Yes I agree with all that. Let's do both =)

[nottrobin]

Approved, assuming you put in the conditional =)

[jkfran]

Approved, assuming you put in the conditional =)

I did! 😃