prevent the LMS/CMS from being renderable in an iframe

[chrisndodge]

@dianakhuang @ormsbee not sure who to ask here

I can't think of an automated test for this. Basically, this just makes sure that someone can't embed the LMS/CMS in an iframe.

[sefk]

Why? I love the idea of people embedding edX in other sites / apps. Fits in to my whole worldview of breaking up courses, modules, syndication and mixups, etc. (If anyone hasn't heard my rant on that, I'd be happy to replay :) )

[chrisndodge]

@sefk just sent out-of-band email on this.

Anyhow, seems like this breaks the LTI tests....

[jbau]

I agree with clickjacking prevention as a goal. I suspect there will be use cases where we want the LMS to be embedded in something as an iframe, and we'll need to work around this in some way (probably more granularity on when to send the header, based on URI).

So I'm philosophically in support of this PR, but anticipating that it'll create future work.

[jbau]

actually wait--this might break your LMS buttons for login and registration, which are iframed in by drupal. And I think we have usage cases where OpenEdX is iframed by coursework.

I think we'll want to use allow-from to whitelist. Can we do it that way instead (there must be some other middleware that's open source and can do this.

https://developer.mozilla.org/en-US/docs/HTTP/X-Frame-Options

[jbau]

Looking here https://github.com/django/django/blob/stable/1.4.x/django/middleware/clickjacking.py
it seems like we can just make settings.X_FRAME_OPTIONS configurable and it'll work. I believe edx.org can use a setting like *.edx.org, and Stanford can do something like *.class.stanford.edu *.coursework.stanford.edu

[chrisndodge]

@jbau good catch! I think you are right. Right now the configuration is to "sameorigin", which I presume does not cover subdomains.

[jbau]

Erm. Looks like allow-from is not well supported: see https://bugs.webkit.org/show_bug.cgi?id=94836

So I guess switching by site (on for certain partners, default off for the rest) is the way to go.

[chrisndodge]

Closing this PR for now as I have to make this more configurable to allow for iframing of the registration button.