[go: nahoru, domu]
Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

allow modifying the default response headers #135

Closed
wants to merge 1 commit into from
Closed

allow modifying the default response headers #135

wants to merge 1 commit into from

Conversation

rspilker
Copy link
Contributor

By default the underlying http server adds several headers:

x-frame-options: SAMEORIGIN
x-xss-protection': 1; mode=block
x-content-type-options: nosniff

It is currently impossible to NOT send such an header.

If I want in my application to allow my page to be visible in an IFRAME, I can only set an illegal value for X-Frame-Options in the after. I cannot remove it.

Regarding x-xss-protection, browsers are removing support for it, in favor of CSP headers.

This feature also allows a more elegant way to centrally add a Strict-Transport-Security header, instead of adding it in an after.

@rspilker
Copy link
Contributor Author

If you decide to merge #134, I can update these test as well.

@rspilker rspilker mentioned this pull request Jan 26, 2020
Merged
@tejainece
Copy link
Member

A question. Why cant this be done in before interceptor?

@tejainece
Copy link
Member

This has been fixed by exposing the underlying HttpServer instance using Jaguar.servers getter.

@tejainece tejainece closed this Apr 27, 2021
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

None yet
2 participants
@rspilker @tejainece