Commits on Oct 4, 2023

1. Disallow any domain from embeding a page to prevent clickjacking …

   Other sites could iframe GOV.UK into theirs and potentially use CSS/JS
   clickjacking to capture keystrokes etc.  It was not done before because in 2020
   there were a couple of instances where non-origin framing was a valid use case
   (e.g. we used to a side-by-side browser for sites transitioning content to
   GOV.UK so the departments could see where their pages will redirect to)
   
   In 2023, the side-by-side browser
   (https://docs.publishing.service.gov.uk/repos/side-by-side-browser.html) is now
   retired, and we now have the GOV.UK Account in place and a potential move
   towards personalisation, so the likelihood of an attacker attempting to steal
   GOV.UK credentials is growing.
   
   Decided to use `frame-ancestors` directive rather than `X-Frame-Options` HTTP
   response header as they have more drawbacks the main one being the fact that
   they are now deprecated.

   

   AgaDufrat committed Oct 4, 2023
   Configuration menu

   • View commit details
   • Copy full SHA for e845ded
   • Browse repository at this point

   Copy the full SHA

   e845ded View commit details

   Browse the repository at this point in the history