Local dashboard is missing frame-ancestors / X-Frame-Options

Open Beginner friendly
#40 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
2/5
Estimated time
1-3 hours
Newbie friendliness
74/100
Issue type
Bug
Clarity
Mostly clear
Activity status
Active
Tech stack
python
Domain
backend, security

Research direction

Start at H._send(), which the issue identifies as the dashboard response path, and inspect how its current headers are assembled. Done means responses from the local dashboard include the three requested protections: frame-ancestors 'none', X-Frame-Options: DENY, and X-Content-Type-Options: nosniff.

Written by the indexing model from the issue text.

Description

Summary

H._send() sets Content-Type, Content-Length, and cache headers only. There is no:

  • Content-Security-Policy (frame-ancestors 'none')
  • X-Frame-Options: DENY
  • X-Content-Type-Options: nosniff

The dashboard is a privileged local UI (delete sessions, connect MCP, install updates, toggle plugins). A page that can still iframe http://127.0.0.1:8722 can clickjack those controls. Host-header checks (see the loopback issue) do not stop that, because the iframe’s Host is legitimately 127.0.0.1.

Chrome Private Network Access helps for some public-site cases; it is not a substitute for frame-ancestors on the server.

Dominant language
Python
Stars
94
Forks
16
Avg merge
1d 12h
Merged PRs (30d)
5

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from splunk/token-meter

All issues in splunk/token-meter

Similar issues

More Python issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.