Add system property to allow for whitelisting domain(s) when clickjacking protection is disabled

XMLWordPrintable

    • 2
    • 5

      NOTE: This suggestion is for Confluence Server. Using Confluence Cloud? See the corresponding suggestion.

      Currently in Confluence Cloud it's possible to turn clickjacking protection off (with the confluence.clickjacking.protection.disable) if customers want to embed their Confluence pages in their own portal. This isn't very safe, so it would be good to have an additional property to allow for setting the X-FRAME-OPTIONS ALLOW-FROM <domain> header to whitelist just the customer's portal domain.

              Assignee:
              Unassigned
              Reporter:
              Nick Mason
              Votes:
              29 Vote for this issue
              Watchers:
              26 Start watching this issue

                Created:
                Updated:
                Resolved: