CODEWITHSUNDEEP
phpsecuritygoogle-app-enginelaravel-5.1clickjacking
Chris Townsend
Chris Townsend

Reputation: 2716

Google App Engine PHP setting x frame options to same origin

I have made an App that has recently gone through a penetration test. I am required to set the X-Frame options in the application to SAMEORIGIN. This is to prevent clickjacking. I believe this is possible in the App.yaml file, but I am not sure how to implement something like this. I have scanned the docs and still can't work out how to deny, only allow.

handlers:
    - url: /.*
          script: public/index.php
          http_headers:
            X-Frame-Options SAMEORIGIN

Upvotes: 1

Views: 1447

Answers (2)

tomsseisums
tomsseisums

Reputation: 13367

To anyone stumbling on this, the reason why the http_headers doesn't work, is because it can only be applied to static file handlers, as mentioned in the doc.:

Optional. You can set HTTP headers for responses of your static file or directory handlers. If you need to set HTTP headers in your script handlers, you should instead do that in your app's code.

Upvotes: 0

Chris Townsend
Chris Townsend

Reputation: 2716

I have found a solution to this using a Middleware within Laravel 5.1

The middleware is called FrameGuard and is stored at the following

Illuminate\Http\Middleware\FrameGuard

To enable this add the following line to the protected middleware array

'Illuminate\Http\Middleware\FrameGuard',

This sets the frame header option to SAMEORIGIN, which can be changed if required.

This prevents the Clickjacking vulnerability in a Laravel application

Upvotes: 1

Related Questions