Browse Source

[core] Set X-Frame-Options to all responses

Even if we protect against them frames with
https://github.com/cloudera/hue/blob/master/desktop/core/src/desktop/templates/common_header.mako#L210
we should set the correct header
Romain Rigaux 10 years ago
parent
commit
aaecadaf87
1 changed files with 1 additions and 0 deletions
  1. 1 0
      desktop/core/src/desktop/settings.py

+ 1 - 0
desktop/core/src/desktop/settings.py

@@ -135,6 +135,7 @@ MIDDLEWARE_CLASSES = [
     'django.middleware.locale.LocaleMiddleware',
     'babeldjango.middleware.LocaleMiddleware',
     'desktop.middleware.AjaxMiddleware',
+    'django.middleware.clickjacking.XFrameOptionsMiddleware',
     # Must be after Session, Auth, and Ajax. Before everything else.
     'desktop.middleware.LoginAndPermissionMiddleware',
     'django.contrib.messages.middleware.MessageMiddleware',