Local dashboard is missing frame-ancestors / X-Frame-Options
Nobody has claimed this yet.
- Dominant language
- Python
- Stars
- 94
- Forks
- 16
- Avg merge
- 1d 12h
- Merged PRs (30d)
- 5
Description
Summary
H._send() sets Content-Type, Content-Length, and cache headers only. There is no:
Content-Security-Policy(frame-ancestors 'none')X-Frame-Options: DENYX-Content-Type-Options: nosniff
The dashboard is a privileged local UI (delete sessions, connect MCP, install updates, toggle plugins). A page that can still iframe http://127.0.0.1:8722 can clickjack those controls. Host-header checks (see the loopback issue) do not stop that, because the iframe’s Host is legitimately 127.0.0.1.
Chrome Private Network Access helps for some public-site cases; it is not a substitute for frame-ancestors on the server.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start at H._send(), which the issue identifies as the dashboard response path, and inspect how its current headers are assembled. Done means responses from the local dashboard include the three requested protections: frame-ancestors 'none', X-Frame-Options: DENY, and X-Content-Type-Options: nosniff.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- backend, security
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Active
- Clarity
- Mostly clear
- Newbie friendliness
- 74/100