Merge pull request #397 from ibuildthecloud/master

Set x-frame-options to sameorigin
rancher · Apr 23, 2021 · 8e6ffc7 · 8e6ffc7
2 parents c7fd1e2 + da77031
commit 8e6ffc7
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/api/writer/html.go b/api/writer/html.go
@@ -43,7 +43,7 @@ type HTMLResponseWriter struct {
 func (h *HTMLResponseWriter) start(apiContext *types.APIContext, code int, obj interface{}) {
 	AddCommonResponseHeader(apiContext)
 	apiContext.Response.Header().Set("content-type", "text/html")
-	apiContext.Response.Header().Set("X-Frame-Options", "deny")
+	apiContext.Response.Header().Set("X-Frame-Options", "SAMEORIGIN")
 	apiContext.Response.WriteHeader(code)
 }