phpmyadmin / phpmyadmin/phpmyadmin
AllowThirdPartyFraming improvement with CSP policy
Nobody has claimed this yet.
- Dominant language
- PHP
- Stars
- 7.9k
- Forks
- 3.6k
- Avg merge
- 4d 18h
- Merged PRs (30d)
- 36
Description
Currently there is a option to enable framing by all websites using AllowThirdPartyFraming option.
It will be better if you provide also a option to supply list of URLs that can frame the page, which will be enforced by the following CSP policy:
https://developer.mozilla.org/en/docs/Web/Security/CSP/CSP_policy_directives#frame-ancestors
for example to add:
AllowThirdPartyFraming="sitethatcanframeme.com"
will add into CSP header:
frame-ancestors sitethatcanframeme.com
will not send X-Frame-Options & JS code against clickjacking (what happen in case AllowThirdPartyFraming=true)
now the possibilities are only:
AllowThirdPartyFraming=false (default) - send X-Frame-Options: DENY & JS code against clickjacking
AllowThirdPartyFraming=true - not send X-Frame-Options & not send JS code against clickjacking
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Search the codebase for AllowThirdPartyFraming and the code that generates CSP, X-Frame-Options, and clickjacking protection. Read how the existing true and false settings are handled, then verify that a configured URL produces the requested frame-ancestors policy without the other protections.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- php
- Domain
- security
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100