You are viewing a plain text version of this content. The canonical link for it is here.
Posted to issues@nifi.apache.org by "Nathan Gough (JIRA)" <ji...@apache.org> on 2018/08/31 15:12:00 UTC
[jira] [Assigned] (NIFI-5366) Implement Content Security Policy
frame-ancestors directive
[ https://issues.apache.org/jira/browse/NIFI-5366?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Nathan Gough reassigned NIFI-5366:
----------------------------------
Assignee: Nathan Gough
> Implement Content Security Policy frame-ancestors directive
> -----------------------------------------------------------
>
> Key: NIFI-5366
> URL: https://issues.apache.org/jira/browse/NIFI-5366
> Project: Apache NiFi
> Issue Type: Improvement
> Components: Core Framework
> Affects Versions: 1.7.0
> Reporter: Andy LoPresto
> Assignee: Nathan Gough
> Priority: Major
> Labels: frame, header, http, security
>
> The {{X-Frame-Options}} headers [1] currently in place to prevent malicious framing / clickjacking [2] are superseded by and should be replaced by the Content Security Policy frame-ancestors [3] directive.
> [1] https://tools.ietf.org/html/rfc7034
> [2] https://en.wikipedia.org/wiki/Clickjacking
> [3] https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/frame-ancestors
--
This message was sent by Atlassian JIRA
(v7.6.3#76005)