Skip to:

  1. Skip to Jira Navigation
  2. Skip to Side Navigation
  3. Skip to Main Content

X-Frame-Options header in Admin returns an invalid value

Description

In OF-997, Admin was enhanced with clickjacking protection with X-Frame-Options header directive. This initially returned a value of "deny" but was updated to return "same".
This generates a console error in Chrome - the correct value is "sameorigin". Without this fix, Admin remains potentially vulnerable to clickjacking.

Environment

None

Activity

Show:

Dan Caseley November 25, 2020 at 3:01 PM

Trivial fix is here:

Requires testing

Dan Caseley November 25, 2020 at 2:58 PM

Work around: Add SAMEORIGIN to the adminConsole.frame-options property

Fixed

Details

Assignee

Reporter

Fix versions

Priority

Created November 25, 2020 at 2:54 PM
Updated January 18, 2021 at 2:34 AM
Resolved January 18, 2021 at 2:34 AM