context: add X-Frame-Options header (#6411)

Co-authored-by: ᴜɴᴋɴᴡᴏɴ <[email protected]>

CHANGELOG.md

@@ -17,6 +17,8 @@ All notable changes to Gogs are documented in this file.
 
 ### Fixed
 
+- Add `X-Frame-Options` header to prevent Clickjacking. [#6409](https://github.com/gogs/gogs/issues/6409) 
+
 ### Removed
 
 - ⚠️ Migrations before 0.12 are removed, installations not on 0.12 should upgrade to it to run the migrations and then upgrade to 0.13.

internal/context/context.go

@@ -289,6 +289,7 @@ func Contexter() macaron.Handler {
 		// 🚨 SECURITY: Prevent MIME type sniffing in some browsers,
 		// see https://github.com/gogs/gogs/issues/5397 for details.
 		c.Header().Set("X-Content-Type-Options", "nosniff")
+		c.Header().Set("X-Frame-Options", "DENY")
 
 		ctx.Map(c)
 	}