[FIX] Replace obsolete X-FRAME-OPTIONS header on Livechat route (#17419)

Replace deprecated X-FRAME-OPTIONS header by Content-Security-Policy. Co-authored-by: Marcos Spessatto Defendi <marcos.defendi@ulbra.inf.br>
RocketChat · May 1, 2020 · ef77a21 · ef77a21
1 parent 2808ce7
commit ef77a21
Showing 1 changed file with 2 additions and 2 deletions.
diff --git a/app/livechat/server/livechat.js b/app/livechat/server/livechat.js
@@ -26,11 +26,11 @@ WebApp.connectHandlers.use('/livechat', Meteor.bindEnvironment((req, res, next)
 
 		const referer = url.parse(req.headers.referer);
 		if (!_.contains(domainWhiteList, referer.host)) {
-			res.setHeader('X-FRAME-OPTIONS', 'DENY');
+			res.setHeader('Content-Security-Policy', 'frame-ancestors \'none\'');
 			return next();
 		}
 
-		res.setHeader('X-FRAME-OPTIONS', `ALLOW-FROM ${ referer.protocol }//${ referer.host }`);
+		res.setHeader('Content-Security-Policy', `frame-ancestors ${ referer.protocol }//${ referer.host }`);
 	}
 
 	res.write(indexHtmlWithServerURL);