splunk / splunk/token-meter

Local dashboard is missing frame-ancestors / X-Frame-Options

Open Beginner friendly
#40 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Python
Stars
94
Forks
16
Avg merge
1d 12h
Merged PRs (30d)
5

Description

Summary

H._send() sets Content-Type, Content-Length, and cache headers only. There is no:

  • Content-Security-Policy (frame-ancestors 'none')
  • X-Frame-Options: DENY
  • X-Content-Type-Options: nosniff

The dashboard is a privileged local UI (delete sessions, connect MCP, install updates, toggle plugins). A page that can still iframe http://127.0.0.1:8722 can clickjack those controls. Host-header checks (see the loopback issue) do not stop that, because the iframe’s Host is legitimately 127.0.0.1.

Chrome Private Network Access helps for some public-site cases; it is not a substitute for frame-ancestors on the server.

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start at H._send(), which the issue identifies as the dashboard response path, and inspect how its current headers are assembled. Done means responses from the local dashboard include the three requested protections: frame-ancestors 'none', X-Frame-Options: DENY, and X-Content-Type-Options: nosniff.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
backend, security
Issue type
Bug
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Active
Clarity
Mostly clear
Newbie friendliness
74/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.