[couchdb-documentation] branch master updated: add X-Frame-Options header documentation (#138)

[ga...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

garren pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/couchdb-documentation.git


The following commit(s) were added to refs/heads/master by this push:
     new 3789a6a  add X-Frame-Options header documentation (#138)
3789a6a is described below

commit 3789a6acf9b8fd6eb81470d344cd3b028e3785a2
Author: garren smith <ga...@gmail.com>
AuthorDate: Fri Jun 30 14:02:44 2017 +0200

    add X-Frame-Options header documentation (#138)
    
    add X-Frame-Options header documentation
---
 src/config/http.rst | 32 ++++++++++++++++++++++++++++++++
 1 file changed, 32 insertions(+)

diff --git a/src/config/http.rst b/src/config/http.rst
index fef5c42..a89bf86 100644
--- a/src/config/http.rst
+++ b/src/config/http.rst
@@ -206,6 +206,13 @@ HTTP Server Options
             [httpd]
             x_forwarded_ssl = X-Forwarded-Ssl
 
+    .. config:option:: enable_xframe_options :: Controls X-Frame-Options header
+
+        Controls :ref:`Enables or disabled <config/xframe_options>` feature::
+
+            [httpd]
+            enable_xframe_options = false
+
     .. config:option:: WWW-Authenticate :: Force basic auth
 
         Set this option to trigger basic-auth popup on unauthorized requests::
@@ -602,3 +609,28 @@ but uses a variable name. And the third one allows you to use any URL with
 
 You could also change the default function to handle request by changing the
 setting :option:`httpd/redirect_vhost_handler`.
+
+.. _xframe_options:
+.. _config/xframe_options:
+
+X-Frame-Options
+=============================
+
+X-Frame-Options is a response header that controls whether a http response
+can be embedded in a <frame>, <iframe> or <object>. This is a security
+feature to help against clickjacking.
+
+    [x_frame_options]
+    ; Settings same-origin will return X-Frame-Options: SAMEORIGIN.
+    ; If same origin is set, it will ignore the hosts setting
+    ; same_origin = true
+    ; Settings hosts will
+    ; return X-Frame-Options: ALLOW-FROM https://example.com/
+    ; List of hosts separated by a comma. * means accept all
+    ; hosts =
+
+If xframe_options is enabled it will return `X-Frame-Options: DENY` by default.
+If `same_origin` is enabled it will return `X-Frame-Options: SAMEORIGIN`.
+A `X-FRAME-OPTIONS: ALLOW-FROM url` will be returned when `same_origin`
+is false, and the HOST header matches one of the urls in the `hosts` config.
+Otherwise a `X-Frame-Options: DENY` will be returned.

-- 
To stop receiving notification emails like this one, please contact
['"commits@couchdb.apache.org" <co...@couchdb.apache.org>'].