moparisthebest
/
mail
mirror of https://github.com/moparisthebest/mail
1
0
Fork 0
Code Issues Releases Wiki Activity

[WO-03-013] Set stricter X-Frame-Options HTTP headers

This commit is contained in:
Tankred Hase 2015-04-23 17:44:30 +02:00
parent 6216fe2f1a
commit 281e53a887
1 changed files with 5 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
server.js
View File

@ -76,7 +76,7 @@ var development = (process.argv[2] === '--dev');
// set HTTP headers
app.use(function(req, res, next) {
// prevent rendering website in foreign iframe (Clickjacking)
res.set('X-Frame-Options', 'SAMEORIGIN');
res.set('X-Frame-Options', 'DENY');
// HSTS
res.set('Strict-Transport-Security', 'max-age=16070400; includeSubDomains');
// CSP
@ -88,11 +88,14 @@ app.use(function(req, res, next) {
res.set('Cache-control', 'public, max-age=0');
next();
});
app.use('/appcache.manifest', function(req, res, next) {
res.set('Cache-control', 'no-cache');
next();
});
app.use('/tpl/read-sandbox.html', function(req, res, next) {
res.set('X-Frame-Options', 'SAMEORIGIN');
next();
});
// redirect all http traffic to https
app.use(function(req, res, next) {