[FIX] Replace obsolete X-FRAME-OPTIONS header on Livechat route (#17419)

Replace deprecated X-FRAME-OPTIONS header by Content-Security-Policy. Co-authored-by: Marcos Spessatto Defendi <[email protected]>
RocketChat · May 1, 2020 · 570c46b · 570c46b
1 parent f417f6d
commit 570c46b
Showing 1 changed file with 2 additions and 2 deletions.
diff --git a/app/livechat/server/livechat.js b/app/livechat/server/livechat.js
@@ -26,11 +26,11 @@ WebApp.connectHandlers.use('/livechat', Meteor.bindEnvironment((req, res, next)
 
 		const referer = url.parse(req.headers.referer);
 		if (!_.contains(domainWhiteList, referer.host)) {
-			res.setHeader('X-FRAME-OPTIONS', 'DENY');
+			res.setHeader('Content-Security-Policy', 'frame-ancestors \'none\'');
 			return next();
 		}
 
-		res.setHeader('X-FRAME-OPTIONS', `ALLOW-FROM ${ referer.protocol }//${ referer.host }`);
+		res.setHeader('Content-Security-Policy', `frame-ancestors ${ referer.protocol }//${ referer.host }`);
 	}
 
 	res.write(indexHtmlWithServerURL);