[ 
https://issues.apache.org/jira/browse/NIFI-5366?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16605108#comment-16605108
 ] 

ASF GitHub Bot commented on NIFI-5366:
--------------------------------------

Github user alopresto commented on the issue:

    https://github.com/apache/nifi/pull/2989
  
    Thanks for making the requested changes. In general, please try to avoid 
rebasing in PRs as it loses the history of the interactions. The 
reviewer/committer should handle that when merging to master. 
    
    +1, merged. 


> Implement Content Security Policy frame-ancestors directive
> -----------------------------------------------------------
>
>                 Key: NIFI-5366
>                 URL: https://issues.apache.org/jira/browse/NIFI-5366
>             Project: Apache NiFi
>          Issue Type: Improvement
>          Components: Core Framework
>    Affects Versions: 1.7.0
>            Reporter: Andy LoPresto
>            Assignee: Nathan Gough
>            Priority: Major
>              Labels: frame, header, http, security
>
> The {{X-Frame-Options}} headers [1] currently in place to prevent malicious 
> framing / clickjacking [2] are superseded by and should be replaced by the 
> Content Security Policy frame-ancestors [3] directive. 
> [1] https://tools.ietf.org/html/rfc7034
> [2] https://en.wikipedia.org/wiki/Clickjacking
> [3] 
> https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/frame-ancestors



--
This message was sent by Atlassian JIRA
(v7.6.3#76005)

Reply via email to