OTWO-7713 CWE-1021: Clickjacking — X-Frame-Options and CSP frame-ance…

app/controllers/accounts_controller.rb

@@ -23,6 +23,10 @@ class AccountsController < ApplicationController
 
   rescue_from ActionController::ParameterMissing, with: :handle_parameter_missing
 
+  # Prevent clickjacking (CWE-1021): block account pages from being embedded in external iframes.
+  # Uses after_action (not content_security_policy DSL) so it runs even when a before_action redirects.
+  after_action :set_clickjacking_headers
+
   def index
     @cbp_map = PeopleDecorator.new(@people).commits_by_project_map
     @positions_map = Position.where(id: @cbp_map.values.map(&:first).flatten)
@@ -93,6 +97,15 @@ def settings; end
 
   private
 
+  def set_clickjacking_headers
+    response.headers['X-Frame-Options'] = 'SAMEORIGIN'
+    if (policy = request.content_security_policy)
+      modified = policy.clone
+      modified.frame_ancestors :self
+      request.content_security_policy = modified
+    end
+  end
+
   def find_claimed_people
     total_entries = params[:query].blank? ? Person::Count.claimed : nil
     @people = Person.find_claimed(params[:query], params[:sort])

config/initializers/clearance_session_security.rb

@@ -0,0 +1,25 @@
+# frozen_string_literal: true
+
+# CWE-1021: Prevent clickjacking on session pages.
+#
+# GET /sessions/new and DELETE /sessions are routed directly to
+# Clearance::SessionsController (bypassing our SessionsController subclass),
+# so security headers are added here via to_prepare, which re-runs on every
+# code reload in development and once at boot in production.
+Rails.application.config.to_prepare do
+  Clearance::SessionsController.class_eval do
+    # Uses after_action (not content_security_policy DSL) so it runs even when a before_action redirects.
+    after_action :set_clickjacking_headers_on_session
+
+    private
+
+    def set_clickjacking_headers_on_session
+      response.headers['X-Frame-Options'] = 'SAMEORIGIN'
+      if (policy = request.content_security_policy)
+        modified = policy.clone
+        modified.frame_ancestors :self
+        request.content_security_policy = modified
+      end
+    end
+  end
+end