How can I add anti-clickjacking X-Frame-Options header to my installation of Discourse?

[opalizoid]

I found security problem with my installation of Discourse.
How can I add http header X-Frame-Option DENY to my app.yml file?

The hosting is DigitalOcean.

I’m scanned forums by Nikto2 and Vega - Penetration Testing Toolkit.

[elijah (Eli the Bearded)]

Add a custom HTTP header to requests made to your Discourse

Add this to your app.yml: ## Remember, this is YAML syntax - you can only have one block with a name run: - exec: echo "Beginning of custom commands" # A man's not dead while his name is still spoken. - replace: filename: "/etc/nginx/conf.d/discourse.conf" from: /location \/ {/ to: | location / { add_header X-Clacks-Overhead "GNU Terry Pratchett"; Make sure to rebuild the container afterwards. [image]

Terry Pratchett, author of the Discworld novels, w…

[opalizoid]

Thank you for link with method to solve problem.

[opalizoid]

Problem is still with /assets/ directory.