Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Removing the XFrameOptionsMiddleware is a security issue. Set X_FRAME_OPTIONS to SAMEORIGIN instead #457

Open
mercelino opened this issue Feb 27, 2023 · 0 comments
Labels
bug Something isn't working

Comments

@mercelino
Copy link

**Bug description **
Removing the XFrameOptionsMiddleware removes the middleware from the entire web application instead of just the concerned views in django admin. This makes the web application less secure and suceptible to clickjacking attacks.

This can be solved by setting the 'X_FRAME_OPTIONS' to 'SAMEORIGIN' instead of removing the middleware.
This way the app stays secure while the simpleui library continues to function correctly

I suggest you also add in the documentation that you are removing the middleware from the settings because it's a very important thing to the security of the web application and people who use your library should be made aware of it.

Another proper way to do this is remove the part of the code where you remove the middleware, and add some steps in the documentation where either the user should remove the middleware himself or add the settings X_FRAME_OPTIONS='SAMEORIGIN'

2.Python Version:3.8

3.Django Version:4.1.2

4.SimpleUI Version:2022.2.16

Description

@mercelino mercelino added the bug Something isn't working label Feb 27, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something isn't working
Projects
None yet
Development

No branches or pull requests

1 participant