From e242aeff3e7882965630cadd5813fce053ccf9ae Mon Sep 17 00:00:00 2001 From: Rob Winch Date: Thu, 1 Aug 2013 10:19:36 -0500 Subject: [PATCH] SEC-2230: Polish and clickjacking demo --- docs/manual/src/docbook/appendix-namespace.xml | 4 ++-- .../src/main/webapp/WEB-INF/contacts-servlet.xml | 15 +++++++++++---- .../src/main/webapp/WEB-INF/jsp/frames.jsp | 10 ++++++++++ .../src/main/webapp/WEB-INF/jsp/hello.jsp | 1 + 4 files changed, 24 insertions(+), 6 deletions(-) create mode 100644 samples/contacts/src/main/webapp/WEB-INF/jsp/frames.jsp diff --git a/docs/manual/src/docbook/appendix-namespace.xml b/docs/manual/src/docbook/appendix-namespace.xml index a5a2492c36..6804e0b43b 100644 --- a/docs/manual/src/docbook/appendix-namespace.xml +++ b/docs/manual/src/docbook/appendix-namespace.xml @@ -348,8 +348,8 @@
<literal><frame-options></literal> - When enabled adds the X-Frame-Options header to the response, this allows newer browsers to do some security - checks and prevent clickjacking attacks. + When enabled adds the X-Frame-Options header to the response, this allows newer browsers to do some security + checks and prevent clickjacking attacks.
<literal><frame-options></literal> Attributes
diff --git a/samples/contacts/src/main/webapp/WEB-INF/contacts-servlet.xml b/samples/contacts/src/main/webapp/WEB-INF/contacts-servlet.xml index 936f16d246..ab318cc88f 100644 --- a/samples/contacts/src/main/webapp/WEB-INF/contacts-servlet.xml +++ b/samples/contacts/src/main/webapp/WEB-INF/contacts-servlet.xml @@ -1,13 +1,20 @@ - + + + + diff --git a/samples/contacts/src/main/webapp/WEB-INF/jsp/frames.jsp b/samples/contacts/src/main/webapp/WEB-INF/jsp/frames.jsp new file mode 100644 index 0000000000..96e928967d --- /dev/null +++ b/samples/contacts/src/main/webapp/WEB-INF/jsp/frames.jsp @@ -0,0 +1,10 @@ + + +Frames + + +

This contains frames, but the frames will not be loaded due to the X-Frame-Options +being specified as denied. This protects against clickjacking attacks

+ + + \ No newline at end of file diff --git a/samples/contacts/src/main/webapp/WEB-INF/jsp/hello.jsp b/samples/contacts/src/main/webapp/WEB-INF/jsp/hello.jsp index 02758ef0b8..8713e0af0c 100644 --- a/samples/contacts/src/main/webapp/WEB-INF/jsp/hello.jsp +++ b/samples/contacts/src/main/webapp/WEB-INF/jsp/hello.jsp @@ -47,5 +47,6 @@ here's a random Contact:

Get started by clicking "Manage"...

">Manage ">Debug +">Frames