Disallow iframes via X-Frame-Options and CSP by default
authorRob Crittenden <rcritten@redhat.com>
Thu, 23 Apr 2015 20:42:27 +0000 (16:42 -0400)
committerPatrick Uiterwijk <puiterwijk@redhat.com>
Fri, 24 Apr 2015 17:10:34 +0000 (19:10 +0200)
A decorator, allow_iframe, is also created so that specific
pages can remove the deny values and allow operating within
a frame.

The Persona plugin relies on iframes and uses this decorator
for all endpoints.

https://fedorahosted.org/ipsilon/ticket/15

Signed-off-by: Rob Crittenden <rcritten@redhat.com>
Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>

No differences found