[
https://issues.apache.org/jira/browse/NIFI-5366?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16605102#comment-16605102
]
ASF GitHub Bot commented on NIFI-5366:
--------------------------------------
Github user alopresto commented on a diff in the pull request:
https://github.com/apache/nifi/pull/2989#discussion_r215465715
--- Diff:
nifi-nar-bundles/nifi-framework-bundle/nifi-framework/nifi-web/nifi-jetty/src/main/java/org/apache/nifi/web/server/JettyServer.java
---
@@ -502,6 +503,11 @@ private WebAppContext loadWar(final File warFile,
final String contextPath, fina
// add a filter to set the X-Frame-Options filter
webappContext.addFilter(new FilterHolder(FRAME_OPTIONS_FILTER),
"/*", EnumSet.allOf(DispatcherType.class));
+ // add a filter to set the Content Security Policy frame-ancestors
directive
+ FilterHolder cspFilter = new FilterHolder(new
ContentSecurityPolicyFilter());
--- End diff --
From what I can tell by tracing the Jetty code, this is almost equivalent
to just assigning the `Filter` directly via `addFilter()`. Do you have a
resource or documentation that indicates why using a `FilterHolder` is
preferable?
> Implement Content Security Policy frame-ancestors directive
> -----------------------------------------------------------
>
> Key: NIFI-5366
> URL: https://issues.apache.org/jira/browse/NIFI-5366
> Project: Apache NiFi
> Issue Type: Improvement
> Components: Core Framework
> Affects Versions: 1.7.0
> Reporter: Andy LoPresto
> Assignee: Nathan Gough
> Priority: Major
> Labels: frame, header, http, security
>
> The {{X-Frame-Options}} headers [1] currently in place to prevent malicious
> framing / clickjacking [2] are superseded by and should be replaced by the
> Content Security Policy frame-ancestors [3] directive.
> [1] https://tools.ietf.org/html/rfc7034
> [2] https://en.wikipedia.org/wiki/Clickjacking
> [3]
> https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/frame-ancestors
--
This message was sent by Atlassian JIRA
(v7.6.3#76005)
