Add Global Clickjacking Protection Headers to ParseServer.app

New Feature / Enhancement Checklist

• Report security issues confidentially. This is not a security vulnerability report.
• Any contribution is under the project license.
• Before posting, I searched existing issues and found no duplicates.

---

Current Limitation

Parse Server does not automatically apply clickjacking protection headers on several routes such as /health, static file routes, or other Public API endpoints.
While the PagesRouter is capable of setting headers like X-Frame-Options and Content-Security-Policy: frame-ancestors,
there is no equivalent global protection applied within the broader ParseServer.app request pipeline.

This results in the following limitations:

• Endpoints like /parse/health can be freely embedded inside external <iframe> elements.
• Security behavior is inconsistent between PagesRouter and the rest of ParseServer.app.
• Developers have no unified way to manage or customize security headers across all responses.

---

Feature / Enhancement Description

A feature is needed to enable global clickjacking protection headers across the entire ParseServer.app layer.

Examples of relevant headers:

• X-Frame-Options: DENY | SAMEORIGIN
• Content-Security-Policy: frame-ancestors 'none' | 'self'

To support this, I propose introducing a global configuration that applies security headers consistently across all Parse Server routes.
One possible implementation approach:

security: {
  secureHeaders: true,          // Enable default clickjacking protection headers
  customHeaders: {              // Allow overrides as needed
    "X-Frame-Options": "SAMEORIGIN",
    "Content-Security-Policy": "frame-ancestors 'self'"
  }
}

Another viable approach is extending the existing pages options to expose similar functionality in a unified way:

pages: {
  enableRouter: true,
  secureHeaders: true,
  customHeaders: {}
}

I can implement this feature and submit a PR based on whichever design direction best aligns with the project’s architecture.

Desired outcome:

• Apply clickjacking protection headers globally within ParseServer.app
• Ensure consistent security behavior across PagesRouter and all other endpoints
• Allow developers to easily customize security headers per deployment needs
• Preserve full backward compatibility while improving default security

---

Example Use Case

1. Install and configure Parse Server normally
2. Load the /parse/health endpoint inside an external <iframe>
3. Currently, the iframe renders the endpoint without restriction
4. When secureHeaders is enabled:
   • All responses from ParseServer.app automatically include X-Frame-Options and CSP frame-ancestors
   • External iframe embedding is blocked
5. Custom policies can be applied to allow only specific admin domains if needed

---

Alternatives / Workarounds

Before implementing this feature, Parse Server did not provide any built-in way to apply clickjacking-related security headers globally. Developers had to rely on one of the following workarounds, each with limitations:

1. PagesRouter secure headers
   • Only apply to PagesRouter responses
   • Not applied to other endpoints such as /health, file routes, or Public API routes
2. Adding a custom Express middleware externally
   • Possible, but breaks consistency with Parse Server’s configuration structure
   • Security behavior becomes fragmented between Parse Server internals and user-defined middleware

With the proposed enhancement (global secureHeaders + customHeaders options), these limitations are removed.

Developers can now configure security headers directly through Parse Server’s built-in options without patching or overriding internal behavior.

---

3rd Party References

Many web frameworks provide global security header functionality by default:

• Express Helmet (helmet.frameguard, helmet.contentSecurityPolicy)
• Django: built-in X-Frame-Options middleware
• Rails: config.action_dispatch.default_headers

To align with common security practice (e.g., OWASP Clickjacking Defense),
Parse Server would benefit from offering global clickjacking protection configuration.

Start with the ParseServer.app request pipeline and the existing PagesRouter security-header handling described in the issue. Decide how the global and custom header configuration should fit the existing options, then verify consistent headers on /health, static file routes, Public API endpoints, and PagesRouter responses.