After a pen test a low impact security flaw was reported saying that X-FRAME-OPTIONS were not being set. Which was odd as following the devdocs recommendation (https://devdocs.magento.com/guides/v2.2/config-guide/secy/secy-xframe.html) we were getting the following in the header of every page.

X-Frame-Options: SAMEORIGIN

The pen testers came back to say that the /soap page wasn't showing this header. So checked with

curl -I --location-trusted https://website-url/soap

and they were right that the header wasn't set on this page (don't know of any others). Navigating to the page opens an xml doc, so is there an additional setting to add the header for this page, this type of page or another change we can make?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.