Merge pull request #3574 from RedisInsight/be/feature/set-x-frame-options-header

Set X-Frame-Options header to routes

Author: ArtemHoruzhenko

redisinsight/api/src/app.module.ts

@@ -5,6 +5,7 @@ import {
 import { ServeStaticModule } from '@nestjs/serve-static';
 import { RouterModule } from '@nestjs/core';
 import { join } from 'path';
+import { Response } from 'express';
 import config, { Config } from 'src/utils/config';
 import { PluginModule } from 'src/modules/plugin/plugin.module';
 import { CommandsModule } from 'src/modules/commands/commands.module';
@@ -33,11 +34,16 @@ import { CliModule } from './modules/cli/cli.module';
 import { StaticsManagementModule } from './modules/statics-management/statics-management.module';
 import { ExcludeRouteMiddleware } from './middleware/exclude-route.middleware';
 import SubpathProxyMiddleware from './middleware/subpath-proxy.middleware';
+import XFrameOptionsMiddleware from './middleware/x-frame-options.middleware';
 import { routes } from './app.routes';
 
 const SERVER_CONFIG = config.get('server') as Config['server'];
 const PATH_CONFIG = config.get('dir_path') as Config['dir_path'];
 
+const setXFrameOptionsHeader = (res: Response) => {
+  res.setHeader('X-Frame-Options', 'SAMEORIGIN');
+};
+
 @Module({
   imports: [
     LocalDatabaseModule,
@@ -73,6 +79,7 @@ const PATH_CONFIG = config.get('dir_path') as Config['dir_path'];
           serveRoot: SERVER_CONFIG.proxyPath ? `/${SERVER_CONFIG.proxyPath}` : '',
           serveStaticOptions: {
             index: false,
+            setHeaders: setXFrameOptionsHeader,
           },
         }),
       ]
@@ -83,6 +90,7 @@ const PATH_CONFIG = config.get('dir_path') as Config['dir_path'];
       exclude: ['/api/**'],
       serveStaticOptions: {
         fallthrough: false,
+        setHeaders: setXFrameOptionsHeader,
       },
     }),
     ServeStaticModule.forRoot({
@@ -91,6 +99,7 @@ const PATH_CONFIG = config.get('dir_path') as Config['dir_path'];
       exclude: ['/api/**'],
       serveStaticOptions: {
         fallthrough: false,
+        setHeaders: setXFrameOptionsHeader,
       },
     }),
     StaticsManagementModule,
@@ -115,7 +124,7 @@ export class AppModule implements OnModuleInit, NestModule {
 
   configure(consumer: MiddlewareConsumer) {
     consumer
-      .apply(SubpathProxyMiddleware)
+      .apply(SubpathProxyMiddleware, XFrameOptionsMiddleware)
       .forRoutes('*');
 
     consumer

redisinsight/api/src/middleware/x-frame-options.middleware.ts

@@ -0,0 +1,10 @@
+import { NestMiddleware, Injectable } from '@nestjs/common';
+import { Request, Response, NextFunction } from 'express';
+
+@Injectable()
+export default class XFrameOptionsMiddleware implements NestMiddleware {
+  use(req: Request, res: Response, next: NextFunction) {
+    res.setHeader('X-Frame-Options', 'SAMEORIGIN');
+    next();
+  }
+}

redisinsight/api/src/modules/statics-management/statics-management.module.ts

@@ -15,6 +15,7 @@ const downloadableStaticFiles = (res: Response) => {
   if (res.req?.query?.download === 'true') {
     res.setHeader('Content-Type', 'application/octet-stream');
     res.setHeader('Content-Disposition', 'attachment;');
+    res.setHeader('X-Frame-Options', 'SAMEORIGIN');
   }
 };