RocketChat / RocketChat/Rocket.Chat
about General Options to X-Frame-Options Added an error header to the generic iFrame
Nobody has claimed this yet.
- Dominant language
- TypeScript
- Stars
- 46.1k
- Forks
- 13.9k
- Avg merge
- 3d 3h
- Merged PRs (30d)
- 130
Description
Description:
Added an error header to the General iFrame
add_header x-frame-options "allow-From https://example.com/";
Due to my local use of Nginx, I have reported an error as follows. The links to the local LAN(http://10.10.10.20:3000) and the reverse proxy cannot be accessed(url https://www.examble.net)

Steps to reproduce:
Expected behavior:
Because of my operation error, the syntax error of adding the header caused my service to be inaccessible. Request to modify this, the wrong syntax should not be added, causing the service to be unable to run
Actual behavior:
Server Setup Information:
- Version of Rocket.Chat Server: 3.8.1
- Operating System: centos8x64
- Deployment Method: Manual Installation
- Number of Running Instances: 2
- DB Replicaset Oplog: wiredTiger
- NodeJS Version: v12.18.4
- MongoDB Version:4.2.3
Client Setup Information
- Desktop App or Browser Version: all
- Operating System:windows
Additional context
Relevant logs:
Loaded: loaded (/usr/lib/systemd/system/rocketchat.service; enabled; vendor preset: disabled)
Active: active (running) since Fri 2020-11-27 22:59:00 CST; 3min 47s ago
Main PID: 153178 (node)
Tasks: 11 (limit: 62658)
Memory: 429.8M
CGroup: /system.slice/rocketchat.service
└─153178 /usr/local/bin/node /opt/Rocket.Chat/main.js
Nov 27 23:01:39 sslchat rocketchat[153178]: at ServerResponse.res.setHeader (/opt/Rocket.Chat/programs/server/npm/node_modules/meteor/simple_json-routes/node_modules/connect/lib/pat>
Nov 27 23:01:39 sslchat rocketchat[153178]: at app/cors/server/cors.js:61:7
Nov 27 23:01:39 sslchat rocketchat[153178]: at /opt/Rocket.Chat/programs/server/npm/node_modules/meteor/promise/node_modules/meteor-promise/fiber_pool.js:43:40 {
Nov 27 23:01:39 sslchat rocketchat[153178]: code: 'ERR_INVALID_CHAR'
Nov 27 23:01:39 sslchat rocketchat[153178]: }
Nov 27 23:01:39 sslchat rocketchat[153178]: ---------------------------------
Nov 27 23:01:39 sslchat rocketchat[153178]: Errors like this can cause oplog processing errors.
Nov 27 23:01:39 sslchat rocketchat[153178]: Setting EXIT_UNHANDLEDPROMISEREJECTION will cause the process to exit allowing your service to automatically restart the process
Nov 27 23:01:39 sslchat rocketchat[153178]: Future node.js versions will automatically exit the process
Nov 27 23:01:39 sslchat rocketchat[153178]: =================================```
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with app/cors/server/cors.js at the reported line 61 and reproduce the invalid X-Frame-Options header while using the described Nginx reverse-proxy setup. Check the Node.js logs for ERR_INVALID_CHAR; the work is complete when the invalid header no longer makes the Rocket.Chat service inaccessible.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- nginx, node.js
- Domain
- backend, security
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100