app-backend: disallow all iframe embedding of the app

Signed-off-by: Patrik Oldsberg <poldsberg@gmail.com>
2021-12-29 11:45:20 +01:00
parent 0fdac13e7d
commit 9d9cfc1b8a
3 changed files with 9 additions and 0 deletions
@@ -16,6 +16,7 @@

 import { notFoundHandler, resolvePackagePath } from '@backstage/backend-common';
 import { Config } from '@backstage/config';
+import helmet from 'helmet';
 import express from 'express';
 import Router from 'express-promise-router';
 import fs from 'fs-extra';
@@ -89,6 +90,8 @@ export async function createRouter(

  const router = Router();

+  router.use(helmet.frameguard({ action: 'deny' }));
+
  // Use a separate router for static content so that a fallback can be provided by backend
  const staticRouter = Router();
  staticRouter.use(express.static(resolvePath(appDistDir, 'static')));