Merge branch 'dz-api-x-frame' into 'security-9-2'

Restrict API X-Frame-Options to same origin See merge request !2103

Merge branch 'dz-api-x-frame' into 'security-9-2'
e1d1a524 · DJ Mountney · 982368dc · e1d1a524
Commit e1d1a524 authored Jun 08, 2017 by DJ Mountney
Hide whitespace changes
Inline Side-by-side

Showing with 1 addition and 0 deletions

api.rb lib/api/api.rb +1 -0

No files found.
--- a/lib/api/api.rb
+++ b/lib/api/api.rb
@@ -45,6 +45,7 @@ module API
    end

    before { allow_access_with_scope :api }
+    before { header['X-Frame-Options'] = 'SAMEORIGIN' }
    before { Gitlab::I18n.locale = current_user&.preferred_language }

    after { Gitlab::I18n.use_default_locale }