Shoumi M
Shoumi M
@crivetimihai Could you please review the proposed solution for the root directory and share your feedback?
@madhav165 @kevalmahajan Could you please review the proposed solution for the root directory and share your feedback?
@sunvk the problem is that `X_FRAME_OPTIONS=*` is not a valid value. The security middleware first validates the `X_FRAME_OPTIONS` value. When it sees an invalid value like `*`, it ignores it...
@sunvk I ran a quick test with the above config on my end and noticed that `X-Frame-Options: DENY` is still being sent even though `X_FRAME_OPTIONS=""`. I'm preparing a PR that...
@sunvk Yes, that's right. Changing from DENY to SAMEORIGIN won't solve the core issue if both domains are different. I'm working on a fix that changes the middleware logic to...