Add system property to allow for whitelisting domain(s) when clickjacking protection is disabled

XMLWordPrintable

    • 2
    • 5

      NOTE: This suggestion is for Confluence Server. Using Confluence Cloud? See the corresponding suggestion.

      Currently in Confluence Cloud it's possible to turn clickjacking protection off (with the confluence.clickjacking.protection.disable) if customers want to embed their Confluence pages in their own portal. This isn't very safe, so it would be good to have an additional property to allow for setting the X-FRAME-OPTIONS ALLOW-FROM <domain> header to whitelist just the customer's portal domain.

            Assignee:
            Unassigned
            Reporter:
            Nick Mason
            Votes:
            29 Vote for this issue
            Watchers:
            26 Start watching this issue

              Created:
              Updated:
              Resolved: