☔ Set some more headers, remove CDN URL & remove unused JSESSIONID

* Set X-Content-Type-Options to nosniff * Set X-Frame-Options to sameorigin (if not configured otherwise) * SockJS iframe fallback no longer embeds sockjs library from a CDN * SockJS no longer rewrites the unused JSESSIONID cookie
OctoPrint · Oct 8, 2019 · fd62c1f · fd62c1f
1 parent a445cfe
commit fd62c1f
Show file tree

Hide file tree

Showing 6 changed files with 25 additions and 4 deletions.
diff --git a/src/octoprint/server/__init__.py b/src/octoprint/server/__init__.py
@@ -536,7 +536,9 @@ def settings_plugin_config_migration_and_cleanup(identifier, implementation):
 
 		self._router = SockJSRouter(self._create_socket_connection, "/sockjs",
 		                            session_kls=util.sockjs.ThreadSafeSession,
-		                            user_settings=dict(websocket_allow_origin="*" if enable_cors else ""))
+		                            user_settings=dict(websocket_allow_origin="*" if enable_cors else "",
+		                                               jsessionid=False,
+		                                               sockjs_url="../../static/js/lib/sockjs.min.js"))
 
 		upload_suffixes = dict(name=self._settings.get(["server", "uploads", "nameSuffix"]), path=self._settings.get(["server", "uploads", "pathSuffix"]))
 
@@ -647,7 +649,11 @@ def joined_dict(*dicts):
 						self._logger.debug("Adding additional route {route} handled by handler {handler} and with additional arguments {kwargs!r}".format(**locals()))
 						server_routes.append((route, handler, kwargs))
 
-		headers =         {"X-Robots-Tag": "noindex, nofollow, noimageindex"}
+		headers =         {"X-Robots-Tag": "noindex, nofollow, noimageindex",
+		                   "X-Content-Type-Options": "nosniff"}
+		if not settings().getBoolean(["server", "allowFraming"]):
+			headers["X-Frame-Options"] = "sameorigin"
+
 		removed_headers = ["Server"]
 
 		server_routes.append((r".*", util.tornado.UploadStorageFallbackHandler, dict(fallback=util.tornado.WsgiInputContainer(app.wsgi_app,

diff --git a/src/octoprint/server/api/settings.py b/src/octoprint/server/api/settings.py
@@ -236,7 +236,8 @@ def getSettings():
 				"enabled": s.getBoolean(["server", "pluginBlacklist", "enabled"]),
 				"url": s.get(["server", "pluginBlacklist", "url"]),
 				"ttl": int(s.getInt(["server", "pluginBlacklist", "ttl"]) / 60)
-			}
+			},
+			"allowFraming": s.getBoolean(["server", "allowFraming"])
 		}
 	}
 
@@ -554,6 +555,8 @@ def _saveSettings(data):
 					s.setInt(["server", "pluginBlacklist", "ttl"], ttl * 60)
 				except ValueError:
 					pass
+		if "allowFraming" in data["server"]:
+			s.setBoolean(["server", "allowFraming"], data["server"]["allowFraming"])
 
 	if "plugins" in data:
 		for plugin in octoprint.plugin.plugin_manager().get_implementations(octoprint.plugin.SettingsPlugin):

diff --git a/src/octoprint/settings.py b/src/octoprint/settings.py
@@ -214,7 +214,8 @@ def settings(init=False, basedir=None, configfile=None):
 		"ipCheck": {
 			"enabled": True,
 			"trustedSubnets": []
-		}
+		},
+		"allowFraming": False
 	},
 	"webcam": {
 		"webcamEnabled": True,

diff --git a/src/octoprint/static/js/app/viewmodels/settings.js b/src/octoprint/static/js/app/viewmodels/settings.js
@@ -244,6 +244,8 @@ $(function() {
         self.server_pluginBlacklist_url = ko.observable();
         self.server_pluginBlacklist_ttl = ko.observable();
 
+        self.server_allowFraming = ko.observable();
+
         self.settings = undefined;
         self.lastReceivedSettings = undefined;
 

diff --git a/src/octoprint/templates/dialogs/settings/server.jinja2 b/src/octoprint/templates/dialogs/settings/server.jinja2
@@ -1,4 +1,6 @@
 <form class="form-horizontal">
+    {% include "snippets/settings/server/serverAllowFraming.jinja2" %}
+
     <h3>{{ _('Commands') }}</h3>
 
     {% include "snippets/settings/server/serverCommandServerRestart.jinja2" %}

diff --git a/src/octoprint/templates/snippets/settings/server/serverAllowFraming.jinja2 b/src/octoprint/templates/snippets/settings/server/serverAllowFraming.jinja2
@@ -0,0 +1,7 @@
+<div class="control-group">
+    <div class="controls">
+        <label class="checkbox">
+            <input type="checkbox" data-bind="checked: server_allowFraming" id="settings-serverAllowFraming"> {{ _('Allow embedding the web interface into a frame or iframe') }} <span class="label">Needs restart</span>
+        </label>
+    </div>
+</div>