Add `X-Frame-Options: DENY` header to prevent clickjacking

[lyoshenka]

See https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Frame-Options

[iamuditpatel]

@lyoshenka thanks for opening this Issue.

@Eniamza i try to fix this above problem but no luck due to my limited knowledge of jekyll but here i find something useful that can help you to fix this problem as you implemented jekyll in this website you get better understanding of jekyll and how it's works.

https://github.com/mattcone/markdown-guide
this above link website use jekyll and it's hosted on github pages like we do and this website already have correct way to add Add X-Frame-Options: DENY header to prevent clickjacking.

but i not touching the base setting of jekyll that you set because if i am not sure what i doing it's good i don't touch the code as fix the problem by luck it's very risky way to solve any problem.

[Eniamza]

I'll be looking into it the next week.

[Eniamza]

@lyoshenka A quick research shows that github forcefully implants xframe: deny in all page. Either It's top level page or not

Therefore both iframe and clickjacking isn’t possible as for writing

Thanks for pointing out!

[lyoshenka]

I don't think that's true. Look at this https://securityheaders.com/?q=https%3A%2F%2Flbry.org&followRedirects=on

[lyoshenka]

It says we're missing a whole bunch of security headers, including X-Frame-Options

[Coolguy3289]

I noticed that lbry.com is covered it seems. Do you know how you were able to add these options for that site? I did some googling and there doesn't seem to be a cut and dry way from what I was reading.

[lyoshenka]

is this running on Github Pages?

lbry.com is not a jekyll site. its php, running on a server. it may be that github pages doesn't let you add these kinds of headers.

[Coolguy3289]

Yes, It's a GH Pages site. Since lbry.com is on Github, I presumed it was GitHub Pages. I don't think we have the ability to add the headers

[Eniamza]

Yes, lbry.org builds as gh pages. Though github doesn’t allow setting security headers

We may follow this : https://www.rzegocki.pl/blog/custom-http-headers-with-github-pages/

Problems :

• Heroku free dyno hours runs approx. 20-25 days per month so it remains inactive in the rest 5 days
• It may add most security headers but not all like Xframe Deny

Solutions

• A credit card can be verified [and removed afterwards] that would give a full month of free dynos
• TBF