gitea-admin/gh-christianlouis-docuelevate
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

docs: address code review comments

Browse Source 
- Fix test count in SECURITY_AUDIT.md (11 tests, not 24)
- Add deprecation note for ALLOW-FROM in X-Frame-Options
- Update documentation to recommend CSP frame-ancestors instead

Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com>
This commit is contained in:
copilot-swe-agent[bot]
2026-02-10 14:10:23 +00:00
parent 68ee832e70
commit 20a0e43a11
3 changed files with 3 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/ConfigurationGuide.md
+1 -1
View File
@@ -159,7 +159,7 @@ Prevents the page from being loaded in frames/iframes. Protects against clickjac
**Valid Values:**
- `DENY` - Page cannot be displayed in a frame (most secure)
- `SAMEORIGIN` - Page can only be displayed in a frame on the same origin
- `ALLOW-FROM uri` - Page can only be displayed in a frame on the specified origin (deprecated in modern browsers)
- ~~`ALLOW-FROM uri`~~ - **Deprecated**: Page can only be displayed in a frame on the specified origin. This directive is deprecated in modern browsers; use CSP `frame-ancestors` directive instead.
#### X-Content-Type-Options