Merge pull request #11307 from jumpserver/pr@dev@perf_add_xframe_option

perf: add iframe option

apps/jumpserver/conf.py

@@ -220,6 +220,9 @@ class Config(dict):
         'ANNOUNCEMENT_ENABLED': True,
         'ANNOUNCEMENT': {},
 
+        # Security
+        'X_FRAME_OPTIONS': 'DENY',
+
         # 未使用的配置
         'CAPTCHA_TEST_MODE': None,
         'DISPLAY_PER_PAGE': 25,

apps/jumpserver/settings/base.py

@@ -334,6 +334,8 @@ AUTH_USER_MODEL = 'users.User'
 FILE_UPLOAD_PERMISSIONS = 0o644
 FILE_UPLOAD_DIRECTORY_PERMISSIONS = 0o755
 
+X_FRAME_OPTIONS = CONFIG.X_FRAME_OPTIONS
+
 # Cache use redis
 REDIS_SSL_KEY = exist_or_default(os.path.join(CERTS_DIR, 'redis_client.key'), None)
 REDIS_SSL_CERT = exist_or_default(os.path.join(CERTS_DIR, 'redis_client.crt'), None)