github
/
halo
mirror of https://github.com/halo-dev/halo
1
0
Fork 0
Code Issues Releases Wiki Activity

Set mode of frame options to SAMEORIGIN (#2761) 

#### What type of PR is this?

/kind bug
/area core

#### What this PR does / why we need it:

The problem https://github.com/halo-dev/halo/issues/2743 was introduced by https://github.com/halo-dev/halo/pull/2729. This Pr mainly resolves it by setting SAMEORIGIN mode for frame options.

![image](https://user-images.githubusercontent.com/16865714/203795956-6efec450-da5f-4222-884d-5a67cb113173.png)

#### Which issue(s) this PR fixes:

Fixes https://github.com/halo-dev/halo/issues/2743

#### Special notes for your reviewer:

#### Does this PR introduce a user-facing change?

```release-note
None
```
pull/2762/head^2
John Niang 2022-11-24 21:39:06 +08:00 committed by GitHub
parent 61c7459ccf
commit 12fd77f61f
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 4 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
src/main/java/run/halo/app/config/WebServerSecurityConfig.java
View File

@ -1,6 +1,7 @@
package run.halo.app.config;
import static org.springframework.security.config.Customizer.withDefaults;
import static org.springframework.security.web.server.header.XFrameOptionsServerHttpHeadersWriter.Mode.SAMEORIGIN;
import com.nimbusds.jose.JWSAlgorithm;
import com.nimbusds.jose.jwk.JWKSet;
@ -60,6 +61,9 @@ public class WebServerSecurityConfig {
.access(new RequestInfoAuthorizationManager(roleService))
.pathMatchers("/**").permitAll()
.and()
.headers()
.frameOptions().mode(SAMEORIGIN)
.and()
.anonymous(anonymousSpec -> {
anonymousSpec.authorities(AnonymousUserConst.Role);
anonymousSpec.principal(AnonymousUserConst.PRINCIPAL);