Add frame-ancestors: 'none' to CSP headers returned by internal server

We already have (and will continue to have) `X-Frame-Options: DENY`,
but this is the more modern version of it.

1 files changed, 3 insertions, 2 deletions

diff --git a/vespalib/src/vespa/vespalib/portal/http_connection.cpp b/vespalib/src/vespa/vespalib/portal/http_connection.cpp
index 2c2a36c1529..6ea56e2659c 100644
--- a/vespalib/src/vespa/vespalib/portal/http_connection.cpp
+++ b/vespalib/src/vespa/vespalib/portal/http_connection.cpp
@@ -103,8 +103,9 @@ void emit_http_security_headers(OutputWriter &dst) {
     // Do not allow embedding via iframe (clickjacking prevention)
     dst.printf("X-Frame-Options: DENY\r\n");
     // Do not allow _anything_ to be externally loaded, nor inline scripts
-    // etc to be executed.
-    dst.printf("Content-Security-Policy: default-src 'none'\r\n");
+    // etc. to be executed.
+    // "frame-ancestors: none" is analogous to X-Frame-Options: DENY.
+    dst.printf("Content-Security-Policy: default-src 'none'; frame-ancestors 'none'\r\n");
     // No heuristic auto-inference of content-type based on payload.
     dst.printf("X-Content-Type-Options: nosniff\r\n");
     // Don't store any potentially sensitive data in any caches.