squidy/qBittorrent
1
0
Fork 0
mirror of https://github.com/qbittorrent/qBittorrent.git synced 2025-12-18 06:28:03 -06:00
Code Issues Packages Projects Releases Wiki Activity

WebUI: set Cross Origin Opener Policy to same-origin

Browse Source 
This separates browsing context for different origin sites and prevents
leaking data from it.
This header is only present when using built-in WebUI. Alternative WebUI
is not affected.
https://web.dev/why-coop-coep/#coop

PR #19157.
This commit is contained in:
Chocobo1
2023-06-14 13:38:48 +08:00
committed by GitHub
parent 79ca2e145f
commit f6b58f36e2
2 changed files with 4 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
src/webui/webapplication.cpp
View File

@@ -406,7 +406,10 @@ void WebApplication::configure()
m_prebuiltHeaders.push_back({Http::HEADER_X_CONTENT_TYPE_OPTIONS, u"nosniff"_qs});
if (!m_isAltUIUsed)
{
m_prebuiltHeaders.push_back({Http::HEADER_CROSS_ORIGIN_OPENER_POLICY, u"same-origin"_qs});
m_prebuiltHeaders.push_back({Http::HEADER_REFERRER_POLICY, u"same-origin"_qs});
}
const bool isClickjackingProtectionEnabled = pref->isWebUiClickjackingProtectionEnabled();
if (isClickjackingProtectionEnabled)