Spring/spring-security
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Deprecate X-FRAME-OPTIONS ALLOW-FROM Directive

Browse Source 
Closes gh-8677
This commit is contained in:
Rob Winch
2020-06-10 10:06:38 -05:00
parent 6fbe58e624
commit a907026eae
10 changed files with 55 additions and 34 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
config/src/main/resources/org/springframework/security/config/spring-security-5.4.rnc
View File

@@ -1034,6 +1034,10 @@ frame-options.attlist &=
attribute value {xsd:string}?
frame-options.attlist &=
## Specify the request parameter to use for the origin when using a 'whitelist' or 'regexp' based strategy. Default is 'from'.
## Deprecated ALLOW-FROM is an obsolete directive that no longer works in modern browsers. Instead use
## Content-Security-Policy with the
## <a href="https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/frame-ancestors">frame-ancestors</a>
## directive.
attribute from-parameter {xsd:string}?

5
config/src/main/resources/org/springframework/security/config/spring-security-5.4.xsd
View File

@@ -3000,7 +3000,10 @@
<xs:attribute name="from-parameter" type="xs:string">
<xs:annotation>
<xs:documentation>Specify the request parameter to use for the origin when using a 'whitelist' or 'regexp'
based strategy. Default is 'from'.
based strategy. Default is 'from'. Deprecated ALLOW-FROM is an obsolete directive that no
longer works in modern browsers. Instead use Content-Security-Policy with the &lt;a
href="https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/frame-ancestors"&gt;frame-ancestors&lt;/a&gt;
directive.
</xs:documentation>
</xs:annotation>
</xs:attribute>

7
config/src/test/java/org/springframework/security/config/doc/XsdDocumentedTests.java
View File

@@ -52,7 +52,12 @@ public class XsdDocumentedTests {
"nsa-websocket-security",
"nsa-ldap",
"nsa-method-security",
"nsa-web");
"nsa-web",
// deprecated and for removal
"nsa-frame-options-strategy",
"nsa-frame-options-ref",
"nsa-frame-options-value",
"nsa-frame-options-from-parameter");
String referenceLocation = "../docs/manual/src/docs/asciidoc/_includes/servlet/appendix/namespace.adoc";