Package Exports
- frameguard
This package does not declare an exports field, so the exports above have been automatically detected and optimized by JSPM instead. If any package subpath is missing, it is recommended to post an issue to the original package (frameguard) to support the "exports" field. If that is not possible, create a JSPM override to customize the exports field for this package.
Readme
X-Frame-Options middleware
The X-Frame-Options HTTP header restricts who can put your site in a frame which can help mitigate things like clickjacking attacks. The header has two modes: DENY and SAMEORIGIN.
This header is superseded by the frame-ancestors Content Security Policy directive but is still useful on old browsers.
If your app does not need to be framed (and most don't) you can use DENY. If your site can be in frames from the same origin, you can set it to SAMEORIGIN.
Usage:
const frameguard = require("frameguard");
// Don't allow me to be in ANY frames:
app.use(frameguard({ action: "deny" }));
// Only let me be framed by people of the same origin:
app.use(frameguard({ action: "sameorigin" }));
app.use(frameguard()); // defaults to sameoriginA legacy action, ALLOW-FROM, is not supported by this middleware. Read more here.