From ac6ec8ac96b584f168ce095383bf6c1f545927a4 Mon Sep 17 00:00:00 2001
From: Robert Speicher <robert@gitlab.com>
Date: Tue, 23 May 2017 18:49:44 +0000
Subject: Merge branch 'dz-api-x-frame' into 'security-9-2'

Restrict API X-Frame-Options to same origin

See merge request !2103
---
 changelogs/unreleased/dz-api-x-frame.yml | 4 ++++
 lib/api/api.rb                           | 1 +
 2 files changed, 5 insertions(+)
 create mode 100644 changelogs/unreleased/dz-api-x-frame.yml

diff --git a/changelogs/unreleased/dz-api-x-frame.yml b/changelogs/unreleased/dz-api-x-frame.yml
new file mode 100644
index 00000000000..0483a9e076a
--- /dev/null
+++ b/changelogs/unreleased/dz-api-x-frame.yml
@@ -0,0 +1,4 @@
+---
+title: Restrict API X-Frame-Options to same origin
+merge_request:
+author:
diff --git a/lib/api/api.rb b/lib/api/api.rb
index 1bf20f76ad6..6b78443cbcb 100644
--- a/lib/api/api.rb
+++ b/lib/api/api.rb
@@ -44,6 +44,7 @@ module API
     end
 
     before { allow_access_with_scope :api }
+    before { header['X-Frame-Options'] = 'SAMEORIGIN' }
 
     rescue_from Gitlab::Access::AccessDeniedError do
       rack_response({ 'message' => '403 Forbidden' }.to_json, 403)
-- 
cgit v1.2.1