qing/blackbird
3
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: X-Frame-Options/frame-ancestors 改为同源以修复条例弹窗空白

Browse Source
This commit is contained in:
qing committed 2026-07-28 11:53:35 +08:00
1 parent 680d28b616
commit 50f209e84a
5 files changed
+12 -11
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

ai_review/security_middleware.py
+2 -2
View File
@@ -12,7 +12,7 @@ def apply_security_headers(app, csp_policy=None):
@app.after_request
def set_security_headers(response):
# Prevent clickjacking
response.headers['X-Frame-Options'] = 'DENY'
response.headers['X-Frame-Options'] = 'SAMEORIGIN'
# XSS protection (legacy browsers)
response.headers['X-XSS-Protection'] = '1; mode=block'
# Prevent MIME type sniffing
@@ -33,7 +33,7 @@ def apply_security_headers(app, csp_policy=None):
"img-src 'self' data: blob:; "
"font-src 'self'; "
"connect-src 'self'; "
"frame-ancestors 'none'"
"frame-ancestors 'self'"
)
# Remove server header info
db/security_middleware.py
+2 -2
View File
@@ -12,7 +12,7 @@ def apply_security_headers(app, csp_policy=None):
@app.after_request
def set_security_headers(response):
# Prevent clickjacking
response.headers['X-Frame-Options'] = 'DENY'
response.headers['X-Frame-Options'] = 'SAMEORIGIN'
# XSS protection (legacy browsers)
response.headers['X-XSS-Protection'] = '1; mode=block'
# Prevent MIME type sniffing
@@ -33,7 +33,7 @@ def apply_security_headers(app, csp_policy=None):
"img-src 'self' data: blob:; "
"font-src 'self'; "
"connect-src 'self'; "
"frame-ancestors 'none'"
"frame-ancestors 'self'"
)
# Remove server header info
dnfs/security_middleware.py
+2 -2
View File
@@ -12,7 +12,7 @@ def apply_security_headers(app, csp_policy=None):
@app.after_request
def set_security_headers(response):
# Prevent clickjacking
response.headers['X-Frame-Options'] = 'DENY'
response.headers['X-Frame-Options'] = 'SAMEORIGIN'
# XSS protection (legacy browsers)
response.headers['X-XSS-Protection'] = '1; mode=block'
# Prevent MIME type sniffing
@@ -33,7 +33,7 @@ def apply_security_headers(app, csp_policy=None):
"img-src 'self' data: blob:; "
"font-src 'self'; "
"connect-src 'self'; "
"frame-ancestors 'none'"
"frame-ancestors 'self'"
)
# Remove server header info
static/security_middleware.py
+3 -3
View File
@@ -11,8 +11,8 @@ def apply_security_headers(app, csp_policy=None):
@app.after_request
def set_security_headers(response):
# Prevent clickjacking
response.headers['X-Frame-Options'] = 'DENY'
# Prevent clickjacking (SAMEORIGIN: 允许本站 iframe 嵌套，如登录页条例弹窗)
response.headers['X-Frame-Options'] = 'SAMEORIGIN'
# XSS protection (legacy browsers)
response.headers['X-XSS-Protection'] = '1; mode=block'
# Prevent MIME type sniffing
@@ -33,7 +33,7 @@ def apply_security_headers(app, csp_policy=None):
"img-src 'self' data: blob:; "
"font-src 'self'; "
"connect-src 'self'; "
"frame-ancestors 'none'"
"frame-ancestors 'self'"
)
# Remove server header info
waf/internal/proxy/proxy.go
+3 -2
View File
@@ -64,7 +64,8 @@ func New(upstream string, waf *engine.Engine) (*Proxy, error) {
// CSP 暂保留 unsafe-inline：forgot.html 与 games/*.html 含内联脚本。
// HSTS 半年期、不含子域，站点全量 HTTPS 后可按需收紧。
func setSecurityHeaders(h http.Header) {
h.Set("X-Frame-Options", "DENY")
// SAMEORIGIN：允许本站 iframe 嵌套（登录页条例弹窗），仍防跨站点击劫持
h.Set("X-Frame-Options", "SAMEORIGIN")
h.Set("X-Content-Type-Options", "nosniff")
h.Set("X-XSS-Protection", "1; mode=block")
h.Set("Referrer-Policy", "strict-origin-when-cross-origin")
@@ -72,7 +73,7 @@ func setSecurityHeaders(h http.Header) {
h.Set("Strict-Transport-Security", "max-age=15552000")
h.Set("Content-Security-Policy",
"default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; "+
"img-src 'self' data: blob:; font-src 'self'; connect-src 'self'; frame-ancestors 'none'")
"img-src 'self' data: blob:; font-src 'self'; connect-src 'self'; frame-ancestors 'self'")
}
// ServeHTTP 实现 http.Handler。