Implement X-Frame-Options header to mitigate Clickjacking

[harshc]

Running security scans on our Uchiwa deployments we found that the webserver is vulnerable to clickjacking
http://www.nessus.org/u?399b1f56
https://www.owasp.org/index.php/Clickjacking_Defense_Cheat_Sheet
http://en.wikipedia.org/wiki/Clickjacking

Particularly in our scans
/bower_components/uchiwa-web/partials/login/ was the page that was scanned and was identified as not having the appropriate response headers.

Expected Behavior

Webserver should mitigate Clickjacking attacks.

Current Behavior

Missing the remediation for Clickjacking

Possible Solution

There are multiple solutions as outlined here
https://www.owasp.org/index.php/Clickjacking_Defense_Cheat_Sheet
One of the simplest options is to enable the X-Frame-Options response header.

Context

In our security and compliance auditing, we ran security scans using Nessus scanner and identified this as a potential issue.

Your Environment

• Uchiwa version used: 0.14.2
• sensu_wrapper::version: '0.3.2'
• sensu_plugin_version: "1.2.0"
• sensu::version: "0.25.3-1"
• Operating System and version (e.g. Ubuntu 14.04): CentOS 6/7