Mirrors/plane
1
0
Fork 0
mirror of https://github.com/makeplane/plane.git synced 2025-12-16 20:07:56 +01:00
Code Issues Packages Projects Releases Wiki Activity

fix: move X-Frame-Options header to auth page for enhanced security (#8179)

Browse Source
This commit is contained in:
Prateek Shourya
2025-11-26 13:57:46 +05:30
committed by GitHub
parent 4806bdf99c
commit ae7898aaee
2 changed files with 7 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
apps/space/app/page.tsx
View File

@@ -9,6 +9,11 @@ import { LogoSpinner } from "@/components/common/logo-spinner";
import { AuthView } from "@/components/views"; import { AuthView } from "@/components/views";
// hooks // hooks
import { useUser } from "@/hooks/store/use-user"; import { useUser } from "@/hooks/store/use-user";
import type { Route } from "./+types/page";
export const headers: Route.HeadersFunction = () => ({
"X-Frame-Options": "SAMEORIGIN",
});
const HomePage = observer(function HomePage() { const HomePage = observer(function HomePage() {
const { data: currentUser, isAuthenticated, isInitializing } = useUser(); const { data: currentUser, isAuthenticated, isInitializing } = useUser();

6
apps/space/app/root.tsx
View File

@@ -1,6 +1,5 @@
import * as Sentry from "@sentry/react-router"; import * as Sentry from "@sentry/react-router";
import { Links, Meta, Outlet, Scripts } from "react-router"; import { Links, Meta, Outlet, Scripts } from "react-router";
import type { HeadersFunction, LinksFunction } from "react-router";
// assets // assets
import appleTouchIcon from "@/app/assets/favicon/apple-touch-icon.png?url"; import appleTouchIcon from "@/app/assets/favicon/apple-touch-icon.png?url";
import favicon16 from "@/app/assets/favicon/favicon-16x16.png?url"; import favicon16 from "@/app/assets/favicon/favicon-16x16.png?url";
@@ -18,7 +17,7 @@ import { AppProviders } from "./providers";
const APP_TITLE = "Plane Publish | Make your Plane boards public with one-click"; const APP_TITLE = "Plane Publish | Make your Plane boards public with one-click";
const APP_DESCRIPTION = "Plane Publish is a customer feedback management tool built on top of plane.so"; const APP_DESCRIPTION = "Plane Publish is a customer feedback management tool built on top of plane.so";
export const links: LinksFunction = () => [ export const links: Route.LinksFunction = () => [
{ rel: "apple-touch-icon", sizes: "180x180", href: appleTouchIcon }, { rel: "apple-touch-icon", sizes: "180x180", href: appleTouchIcon },
{ rel: "icon", type: "image/png", sizes: "32x32", href: favicon32 }, { rel: "icon", type: "image/png", sizes: "32x32", href: favicon32 },
{ rel: "icon", type: "image/png", sizes: "16x16", href: favicon16 }, { rel: "icon", type: "image/png", sizes: "16x16", href: favicon16 },
@@ -27,9 +26,8 @@ export const links: LinksFunction = () => [
{ rel: "stylesheet", href: globalStyles }, { rel: "stylesheet", href: globalStyles },
]; ];
export const headers: HeadersFunction = () => ({ export const headers: Route.HeadersFunction = () => ({
"Referrer-Policy": "origin-when-cross-origin", "Referrer-Policy": "origin-when-cross-origin",
"X-Frame-Options": "SAMEORIGIN",
"X-Content-Type-Options": "nosniff", "X-Content-Type-Options": "nosniff",
"X-DNS-Prefetch-Control": "on", "X-DNS-Prefetch-Control": "on",
"Strict-Transport-Security": "max-age=31536000; includeSubDomains; preload", "Strict-Transport-Security": "max-age=31536000; includeSubDomains; preload",