Merge pull request #2412 from MetaMask/x-frame-options

mascara - set x-frame-options header to DENY
7 years ago · 2a18f732c7
parent e3a7da961d 5c902423d9
commit 2a18f732c7
1 changed files with 1 additions and 1 deletions
--- a/mascara/server/index.js
+++ b/mascara/server/index.js
@ -17,7 +17,7 @@ function createMetamascaraServer () {
  const server = express()
  // ui window
  serveBundle(server, '/ui.js', uiBundle)
-  server.use(express.static(__dirname + '/../ui/'))
+  server.use(express.static(__dirname + '/../ui/', { setHeaders: (res) => res.set('X-Frame-Options', 'DENY') }))
  server.use(express.static(__dirname + '/../../dist/chrome'))
  // metamascara
  serveBundle(server, '/metamascara.js', metamascaraBundle)