Skip to content

[Pentest] Potential clickjacking attack #3707

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
pini-sh-panda wants to merge 4 commits into
base: feature/ig4
Choose a base branch
from
Open

[Pentest] Potential clickjacking attack #3707

Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
fd46f70
merge with the development
Jun 22, 2026
3e07b27
update the nuclio remoteEntryUrl condition
Jun 23, 2026
22910f0
Merge remote-tracking branch 'upstream/feature/ig4' into feature/ig4
Jun 23, 2026
7c5a647
fix(nginx): add X-Frame-Options and Content-Security-Policy headers
Jun 23, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 3 additions & 4 deletions nginx/nginx.conf.tmpl
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,10 +7,9 @@ server {
# Basic Gzip as per standard defaults
gzip on;

# CRITICAL: Allow the Global Host (IGZ) to fetch these assets
add_header Access-Control-Allow-Origin *;
add_header Access-Control-Allow-Methods 'GET, OPTIONS';
add_header Access-Control-Allow-Headers 'Content-Type, Authorization';
# Clickjacking protection
add_header X-Frame-Options "DENY" always;
add_header Content-Security-Policy "frame-ancestors 'none';" always;

location / {
# Show landing page when accessing the remote directly
Expand Down
Loading