Spring/spring-security
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Deprecate X-FRAME-OPTIONS ALLOW-FROM Directive

Browse Source 
Closes gh-8677
This commit is contained in:
Rob Winch
2020-06-10 10:06:38 -05:00
parent 6fbe58e624
commit a907026eae
10 changed files with 55 additions and 34 deletions
Download Patch File Download Diff File Expand all files Collapse all files

31
docs/manual/src/docs/asciidoc/_includes/servlet/appendix/namespace.adoc
View File

@@ -504,43 +504,12 @@ Default false.
** `DENY` The page cannot be displayed in a frame, regardless of the site attempting to do so.
This is the default when frame-options-policy is specified.
** `SAMEORIGIN` The page can only be displayed in a frame on the same origin as the page itself
** `ALLOW-FROM origin` The page can only be displayed in a frame on the specified origin.
+
In other words, if you specify DENY, not only will attempts to load the page in a frame fail when loaded from other sites, attempts to do so will fail when loaded from the same site.
On the other hand, if you specify SAMEORIGIN, you can still use the page in a frame as long as the site including it in a frame it is the same as the one serving the page.
[[nsa-frame-options-strategy]]
* **strategy**
Select the `AllowFromStrategy` to use when using the ALLOW-FROM policy.
** `static` Use a single static ALLOW-FROM value.
The value can be set through the <<nsa-frame-options-value,value>> attribute.
** `regexp` Use a regular expression to validate incoming requests and if they are allowed.
The regular expression can be set through the <<nsa-frame-options-value,value>> attribute.
The request parameter used to retrieve the value to validate can be specified using the <<nsa-frame-options-from-parameter,from-parameter>>.
** `whitelist` A comma-separated list containing the allowed domains.
The comma-separated list can be set through the <<nsa-frame-options-value,value>> attribute.
The request parameter used to retrieve the value to validate can be specified using the <<nsa-frame-options-from-parameter,from-parameter>>.
[[nsa-frame-options-ref]]
* **ref**
Instead of using one of the predefined strategies it is also possible to use a custom `AllowFromStrategy`.
The reference to this bean can be specified through this ref attribute.
[[nsa-frame-options-value]]
* **value**
The value to use when ALLOW-FROM is used a <<nsa-frame-options-strategy,strategy>>.
[[nsa-frame-options-from-parameter]]
* **from-parameter**
Specify the name of the request parameter to use when using regexp or whitelist for the ALLOW-FROM strategy.
[[nsa-frame-options-parents]]