Mirror
/
zulip
mirror of https://github.com/zulip/zulip.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

[puppet] Allow Zulip to be loaded in an iframe on all domains 

This removes "X-Frame-Options DENY" from our nginx config.  We need to be able
to load Zulip in an iframe for embedding and we decided that it doesn't actually
provide much protection.

(imported from commit 5bc363693db949010f6163cb3000c12229618a83)
This commit is contained in:
Zev Benjamin 2014-04-07 14:35:06 -07:00
parent 3498a04613
commit caef3f8bf3
3 changed files with 0 additions and 15 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
puppet/zulip/files/nginx/sites-available/zulip-enterprise
View File

@ -12,8 +12,6 @@ server {
ssl_certificate /etc/ssl/certs/zulip-enterprise.combined-chain.crt;
ssl_certificate_key /etc/ssl/private/zulip-enterprise.key;
add_header X-Frame-Options DENY;
location /user_uploads {
add_header X-Content-Type-Options nosniff;
include /etc/nginx/zulip-include/uploads.types;

10
puppet/zulip_internal/files/nginx/sites-available/zulip
View File

@ -26,9 +26,6 @@ server {
server_name zephyr.humbughq.com zephyr.zulip.com;
# Avoid clickjacking attacks
add_header X-Frame-Options DENY;
include /etc/nginx/zulip-include/app;
}
@ -42,10 +39,6 @@ server {
server_name customer29.zulip.com;
## We need to support running Zulip in an iframe for this
## application, so X-Frame-Options is not set.
# add_header X-Frame-Options DENY;
include /etc/nginx/zulip-include/app;
}
@ -61,9 +54,6 @@ server {
# clients will never be accessing this host directly.
server_name humbughq.com www.humbughq.com zulip.com www.zulip.com;
# Avoid clickjacking attacks
add_header X-Frame-Options DENY;
# Downloadable software
location /dist/ {
autoindex on;

3
puppet/zulip_internal/files/nginx/sites-available/zulip-staging
View File

@ -15,8 +15,5 @@ server {
server_name staging.zulip.com;
# Avoid clickjacking attacks
add_header X-Frame-Options DENY;
include /etc/nginx/zulip-include/app;
}