PS-743 Move from X-Frame-Options to Content-Security-Policy: frame-an…

…cestors (#498)
alchemy-fr · Dec 2, 2024 · 36e3390 · 36e3390
1 parent b092ac7
commit 36e3390
Show file tree

Hide file tree

Showing 7 changed files with 8 additions and 5 deletions.
diff --git a/expose/api/docker/nginx/entrypoint.sh b/expose/api/docker/nginx/entrypoint.sh
@@ -1,5 +1,5 @@
 #!/bin/sh
 
-envsubst '$UPLOAD_MAX_FILE_SIZE,$PS_SUBNET' < /etc/nginx/tpl/default.conf > /etc/nginx/conf.d/default.conf
+envsubst '${UPLOAD_MAX_FILE_SIZE},${PS_SUBNET},${DASHBOARD_CLIENT_URL}' < /etc/nginx/tpl/default.conf > /etc/nginx/conf.d/default.conf
 
 exec "$@"
diff --git a/expose/api/docker/nginx/tpl/default.conf b/expose/api/docker/nginx/tpl/default.conf
@@ -9,7 +9,7 @@ server {
 
     add_header X-Robots-Tag "noindex, nofollow";
     add_header X-Content-Type-Options "nosniff";
-    add_header X-Frame-Options "deny";
+    add_header Content-Security-Policy "frame-ancestors 'self' ${DASHBOARD_CLIENT_URL}";
     add_header Strict-Transport-Security "max-age=31536000; includeSubDomains";
 
     client_max_body_size $UPLOAD_MAX_FILE_SIZE;

diff --git a/infra/docker/nginx-client-base/Dockerfile b/infra/docker/nginx-client-base/Dockerfile
@@ -15,6 +15,7 @@ RUN apk update \
 
 COPY entrypoint.sh /entrypoint.sh
 COPY nginx/conf.d/* /etc/nginx/conf.d/
+COPY tpl /etc/nginx/tpl
 
 EXPOSE 80
 

diff --git a/infra/docker/nginx-client-base/entrypoint.sh b/infra/docker/nginx-client-base/entrypoint.sh
@@ -9,4 +9,6 @@ if [ -d /docker/entrypoint.d ]; then
   unset i
 fi
 
+envsubst '${DASHBOARD_CLIENT_URL}' < /etc/nginx/tpl/default.conf > /etc/nginx/conf.d/default.conf
+
 exec "$@"
diff --git a/...inx-client-base/nginx/conf.d/default.conf → ...docker/nginx-client-base/tpl/default.conf b/...inx-client-base/nginx/conf.d/default.conf → ...docker/nginx-client-base/tpl/default.conf
@@ -3,7 +3,7 @@ server {
 
     add_header X-Robots-Tag "noindex, nofollow";
     add_header X-Content-Type-Options "nosniff";
-    add_header X-Frame-Options "deny";
+    add_header Content-Security-Policy "frame-ancestors 'self' ${DASHBOARD_CLIENT_URL}";
     add_header Strict-Transport-Security "max-age=31536000; includeSubDomains";
 
     root /var/app;

diff --git a/infra/docker/nginx-fpm-base/entrypoint.sh b/infra/docker/nginx-fpm-base/entrypoint.sh
@@ -1,5 +1,5 @@
 #!/bin/sh
 
-envsubst '${FPM_HOSTNAME} ${UPLOAD_MAX_FILE_SIZE}' < /etc/nginx/tpl/default.conf > /etc/nginx/conf.d/default.conf
+envsubst '${FPM_HOSTNAME},${UPLOAD_MAX_FILE_SIZE},${DASHBOARD_CLIENT_URL}' < /etc/nginx/tpl/default.conf > /etc/nginx/conf.d/default.conf
 
 exec "$@"
diff --git a/infra/docker/nginx-fpm-base/tpl/default.conf b/infra/docker/nginx-fpm-base/tpl/default.conf
@@ -7,7 +7,7 @@ server {
 
     add_header X-Robots-Tag "noindex, nofollow";
     add_header X-Content-Type-Options "nosniff";
-    add_header X-Frame-Options "deny";
+    add_header Content-Security-Policy "frame-ancestors 'self' ${DASHBOARD_CLIENT_URL}";
     add_header Strict-Transport-Security "max-age=31536000; includeSubDomains";
 
     location / {
-Original file line number
+Diff line change
@@ Expand Up / @@ -9,4 +9,6 @@ if [ -d /docker/entrypoint.d ]; then @@
       unset i
     fi
+    envsubst '${DASHBOARD_CLIENT_URL}' < /etc/nginx/tpl/default.conf > /etc/nginx/conf.d/default.conf
     exec "$@"