@@ -188,6 +188,9 @@ var globals struct {
188
188
// Prioritize X-Forwarded-For header as the source of IP address of the client.
189
189
useXForwardedFor bool
190
190
191
+ // Add X-Frame-Options header to HTTP response.
192
+ xFrameOptions string
193
+
191
194
// Country code to assign to sessions by default.
192
195
defaultCountryCode string
193
196
@@ -286,6 +289,9 @@ type configType struct {
286
289
// Take IP address of the client from HTTP header 'X-Forwarded-For'.
287
290
// Useful when tinode is behind a proxy. If missing, fallback to default RemoteAddr.
288
291
UseXForwardedFor bool `json:"use_x_forwarded_for"`
292
+ // Add X-Frame-Options to HTTP response headers. It should be one of "DENY", "SAMEORIGIN",
293
+ // "-" (disabled). The default is SAMEORIGIN.
294
+ XFrameOptions string `json:"x_frame_options"`
289
295
// 2-letter country code (ISO 3166-1 alpha-2) to assign to sessions by default
290
296
// when the country isn't specified by the client explicitly and
291
297
// it's impossible to infer it.
@@ -556,6 +562,16 @@ func main() {
556
562
globals .defaultCountryCode = defaultCountryCode
557
563
}
558
564
565
+ // Configuration of X-Frame-Options header.
566
+ globals .xFrameOptions = config .XFrameOptions
567
+ if globals .xFrameOptions == "" {
568
+ globals .xFrameOptions = "SAMEORIGIN"
569
+ }
570
+ if globals .xFrameOptions != "SAMEORIGIN" && globals .xFrameOptions != "DENY" && globals .xFrameOptions != "-" {
571
+ logs .Warn .Println ("Ignored invalid x_frame_options" , config .XFrameOptions )
572
+ globals .xFrameOptions = "SAMEORIGIN"
573
+ }
574
+
559
575
// Websocket compression.
560
576
globals .wsCompression = ! config .WSCompressionDisabled
561
577
@@ -666,15 +682,15 @@ func main() {
666
682
}
667
683
}
668
684
mux .Handle (staticMountPoint ,
669
- // Add optional Cache-Control header
685
+ // Add optional Cache-Control header.
670
686
cacheControlHandler (config .CacheControl ,
671
- // Optionally add Strict-Transport_security to the response
672
- hstsHandler (
673
- // Add gzip compression
687
+ // Optionally add Strict-Transport-Security and X-Frame-Options to the response.
688
+ optionalHttpHeaders (
689
+ // Add gzip compression.
674
690
gh .CompressHandler (
675
691
// And add custom formatter of errors.
676
692
httpErrorHandler (
677
- // Remove mount point prefix
693
+ // Remove mount point prefix.
678
694
http .StripPrefix (staticMountPoint ,
679
695
http .FileServer (http .Dir (* staticPath ))))))))
680
696
logs .Info .Printf ("Serving static content from '%s' at '%s'" , * staticPath , staticMountPoint )
0 commit comments