OpenCloud
/
riot-web
mirror of https://github.com/vector-im/riot-web
1
0
Fork 0
Code Issues Releases Wiki Activity

Update README.md

pull/24827/head
Michael Telatynski 2023-03-14 11:27:05 +00:00 committed by GitHub
parent 93d2112bfe
commit 4a18ab6d1b
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
README.md
View File

@ -85,7 +85,7 @@ your web server configuration when hosting Element Web:
- The `X-Frame-Options: SAMEORIGIN` header, to prevent Element Web from being - The `X-Frame-Options: SAMEORIGIN` header, to prevent Element Web from being
framed and protect from [clickjacking][owasp-clickjacking]. framed and protect from [clickjacking][owasp-clickjacking].
- The `frame-ancestors 'none'` directive to your `Content-Security-Policy` - The `frame-ancestors 'self'` directive to your `Content-Security-Policy`
header, as the modern replacement for `X-Frame-Options` (though both should be header, as the modern replacement for `X-Frame-Options` (though both should be
included since not all browsers support it yet, see included since not all browsers support it yet, see
[this][owasp-clickjacking-csp]). [this][owasp-clickjacking-csp]).
@ -113,7 +113,7 @@ For Apache, the configuration looks like:
Header set X-Frame-Options SAMEORIGIN Header set X-Frame-Options SAMEORIGIN
Header set X-Content-Type-Options nosniff Header set X-Content-Type-Options nosniff
Header set X-XSS-Protection "1; mode=block" Header set X-XSS-Protection "1; mode=block"
Header set Content-Security-Policy "frame-ancestors 'none'" Header set Content-Security-Policy "frame-ancestors 'self'"
``` ```
Note: In case you are already setting a `Content-Security-Policy` header Note: In case you are already setting a `Content-Security-Policy` header