Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

X-Frame-Options set two times #10280

Closed
SchoolGuy opened this issue Jul 18, 2018 · 5 comments · Fixed by #19002
Closed

X-Frame-Options set two times #10280

SchoolGuy opened this issue Jul 18, 2018 · 5 comments · Fixed by #19002
Labels
3. to review Waiting for reviews enhancement
Milestone

Comments

@SchoolGuy
Copy link

Steps to reproduce

  1. Set in your apache2.conf the "X-Frame-Options: SAMEORIGIN"
  2. Look at the Admin Dashboard.
  3. See the warning, that the "X-Frame-Options: SAMEORIGIN" are not set.

Expected behaviour

I did expect that Nextcloud either not double sets the "X-Frame-Options: SAMEORIGIN" or that there is at least no warning at the admin dashboard.

Actual behaviour

On the admin dashboard there is appearing the warning that the "X-Frame-Options: SAMEORIGIN" is not set.

Server configuration

Operating system: Ubuntu 16.04

Web server: Apache2

Database: MariaDB

PHP version: 7.2.7

Nextcloud version: 13.0.4

Updated from an older Nextcloud/ownCloud or fresh install: Yes

Where did you install Nextcloud from: Official downloadserver as a ZIP

Signing status:

Signing status No errors have been found.

List of activated apps:

App list
Enabled:
  - activity: 2.6.1
  - admin_audit: 1.3.0
  - admin_notifications: 1.0.1
  - announcementcenter: 3.2.1
  - audioplayer: 2.3.1
  - bruteforcesettings: 1.1.0
  - calendar: 1.6.1
  - caniupdate: 0.1.2
  - comments: 1.3.0
  - contacts: 2.1.5
  - dav: 1.4.7
  - deck: 0.4.0
  - federatedfilesharing: 1.3.1
  - federation: 1.3.0
  - files: 1.8.0
  - files_automatedtagging: 1.3.0
  - files_downloadactivity: 1.2.0
  - files_pdfviewer: 1.2.1
  - files_sharing: 1.5.0
  - files_texteditor: 2.5.1
  - files_trashbin: 1.3.0
  - files_versions: 1.6.0
  - files_videoplayer: 1.2.0
  - firstrunwizard: 2.2.1
  - gallery: 18.0.0
  - impersonate: 1.0.4
  - logreader: 2.0.0
  - lookup_server_connector: 1.1.0
  - mail: 0.8.2
  - metadata: 0.6.0
  - nextcloud_announcements: 1.2.0
  - notifications: 2.1.2
  - oauth2: 1.1.1
  - password_policy: 1.3.0
  - previewgenerator: 1.0.9
  - provisioning_api: 1.3.0
  - richdocuments: 2.0.10
  - serverinfo: 1.3.0
  - sharebymail: 1.3.0
  - socialsharing_email: 1.0.3
  - survey_client: 1.1.0
  - systemtags: 1.3.0
  - tasks: 0.9.6
  - theming: 1.4.5
  - twofactor_backupcodes: 1.2.3
  - twofactor_totp: 1.4.1
  - updatenotification: 1.3.0
  - user_external: 0.4
  - user_ldap: 1.3.1
  - workflowengine: 1.3.0
Disabled:
  - encryption
  - files_external

Nextcloud configuration:

Config report
{
    "system": {
        "instanceid": "***REMOVED SENSITIVE VALUE***",
        "passwordsalt": "***REMOVED SENSITIVE VALUE***",
        "secret": "***REMOVED SENSITIVE VALUE***",
        "trusted_domains": [
            "nextcloud.*.de"
        ],
        "datadirectory": "***REMOVED SENSITIVE VALUE***",
        "overwrite.cli.url": "https:\/\/nextcloud.*****.de",
        "dbtype": "mysql",
        "version": "13.0.4.0",
        "dbname": "***REMOVED SENSITIVE VALUE***",
        "dbhost": "***REMOVED SENSITIVE VALUE***",
        "dbport": "",
        "dbtableprefix": "oc_",
        "dbuser": "***REMOVED SENSITIVE VALUE***",
        "dbpassword": "***REMOVED SENSITIVE VALUE***",
        "installed": true,
        "ldapIgnoreNamingRules": false,
        "ldapProviderFactory": "\\OCA\\User_LDAP\\LDAPProviderFactory",
        "htaccess.RewriteBase": "\/",
        "memcache.local": "\\OC\\Memcache\\Redis",
        "redis": {
            "host": "***REMOVED SENSITIVE VALUE***",
            "port": 6379
        },
        "memcache.locking": "\\OC\\Memcache\\Redis",
        "maintenance": false,
        "theme": "",
        "loglevel": 2,
        "updater.release.channel": "stable",
        "mail_smtpmode": "smtp",
        "mail_smtpauthtype": "LOGIN",
        "mail_smtpsecure": "ssl",
        "mail_smtpauth": 1,
        "mail_from_address": "***REMOVED SENSITIVE VALUE***",
        "mail_domain": "***REMOVED SENSITIVE VALUE***",
        "mail_smtphost": "***REMOVED SENSITIVE VALUE***",
        "mail_smtpport": "465",
        "mail_smtpname": "***REMOVED SENSITIVE VALUE***",
        "mail_smtppassword": "***REMOVED SENSITIVE VALUE***"
    }
}

Are you using external storage, if yes which one: No, internal only

Are you using encryption: No

Are you using an external user-backend, if yes which one: OpenLDAP

LDAP configuration (delete this part if not used)

LDAP config
+-------------------------------+---------------------------------------------------------------------------------------------------------------------------------------------+
| Configuration                 |                                                                                                                                             |
+-------------------------------+---------------------------------------------------------------------------------------------------------------------------------------------+
| hasMemberOfFilterSupport      | 1                                                                                                                                           |
| hasPagedResultSupport         |                                                                                                                                             |
| homeFolderNamingRule          |                                                                                                                                             |
| lastJpegPhotoLookup           | 0                                                                                                                                           |
| ldapAgentName                 | cn=admin,dc=***,dc=de                                                                                                                     |
| ldapAgentPassword             | ***                                                                                                                                         |
| ldapAttributesForGroupSearch  |                                                                                                                                             |
| ldapAttributesForUserSearch   |                                                                                                                                             |
| ldapBackupHost                |                                                                                                                                             |
| ldapBackupPort                |                                                                                                                                             |
| ldapBase                      | dc=***,dc=de                                                                                                                              |
| ldapBaseGroups                | dc=***,dc=de                                                                                                                              |
| ldapBaseUsers                 | dc=***,dc=de                                                                                                                              |
| ldapCacheTTL                  | 600                                                                                                                                         |
| ldapConfigurationActive       | 1                                                                                                                                           |
| ldapDefaultPPolicyDN          |                                                                                                                                             |
| ldapDynamicGroupMemberURL     |                                                                                                                                             |
| ldapEmailAttribute            | mail                                                                                                                                        |
| ldapExperiencedAdmin          | 0                                                                                                                                           |
| ldapExpertUUIDGroupAttr       |                                                                                                                                             |
| ldapExpertUUIDUserAttr        |                                                                                                                                             |
| ldapExpertUsernameAttr        |                                                                                                                                             |
| ldapGidNumber                 | gidNumber                                                                                                                                   |
| ldapGroupDisplayName          | cn                                                                                                                                          |
| ldapGroupFilter               | (|(cn=collaboraOffice)(cn=nextcloud))                                                                                                       |
| ldapGroupFilterGroups         | collaboraOffice;nextcloud                                                                                                                   |
| ldapGroupFilterMode           | 0                                                                                                                                           |
| ldapGroupFilterObjectclass    |                                                                                                                                             |
| ldapGroupMemberAssocAttr      | member                                                                                                                                      |
| ldapHost                      | ***.de                                                                                                                                    |
| ldapIgnoreNamingRules         |                                                                                                                                             |
| ldapLoginFilter               | (&(&(|(objectclass=inetOrgPerson))(|(memberof=cn=nextcloud,ou=groups,dc=***,dc=de)))(|(uid=%uid)(|(mailPrimaryAddress=%uid)(mail=%uid)))) |
| ldapLoginFilterAttributes     |                                                                                                                                             |
| ldapLoginFilterEmail          | 1                                                                                                                                           |
| ldapLoginFilterMode           | 0                                                                                                                                           |
| ldapLoginFilterUsername       | 1                                                                                                                                           |
| ldapNestedGroups              | 0                                                                                                                                           |
| ldapOverrideMainServer        |                                                                                                                                             |
| ldapPagingSize                | 500                                                                                                                                         |
| ldapPort                      | 389                                                                                                                                         |
| ldapQuotaAttribute            |                                                                                                                                             |
| ldapQuotaDefault              |                                                                                                                                             |
| ldapTLS                       | 0                                                                                                                                           |
| ldapUserDisplayName           | cn                                                                                                                                          |
| ldapUserDisplayName2          |                                                                                                                                             |
| ldapUserFilter                | (&(|(objectclass=inetOrgPerson))(|(memberof=cn=nextcloud,ou=groups,dc=***,dc=de)))                                                        |
| ldapUserFilterGroups          | nextcloud                                                                                                                                   |
| ldapUserFilterMode            | 0                                                                                                                                           |
| ldapUserFilterObjectclass     | inetOrgPerson                                                                                                                               |
| ldapUuidGroupAttribute        | auto                                                                                                                                        |
| ldapUuidUserAttribute         | auto                                                                                                                                        |
| turnOffCertCheck              | 0                                                                                                                                           |
| turnOnPasswordChange          | 0                                                                                                                                           |
| useMemberOfToDetectMembership | 1                                                                                                                                           |
+-------------------------------+---------------------------------------------------------------------------------------------------------------------------------------------+

Client configuration

Browser: Firefox

Operating system: Ubuntu/Windows

Logs

Web server error log

Web server error log No errors present.

Nextcloud log (data/nextcloud.log)

Nextcloud log Not relevant

Browser log

Browser log Not relevant
@nextcloud-bot
Copy link
Member

GitMate.io thinks possibly related issues are #543 (X-Frame-Options set to Deny issues a security warning), #5246 (X-Frame-Options headers conflicting values), #4863 (X-Frame-Option DENY - NGINX), #3318 (Misleading error message regarding X-Frame-Options), and #3808 (Nextcloud complains if X-Frame-Options is too 'secure').

@SchoolGuy
Copy link
Author

I can confirm that all issues that the bot found are related. Possible solution from my point of view is that Nextcloud is not adding headers which are added through the webserver. This solution would fit all needs. You want to increase the strength, fine, you want to decrease the strength, not fine but the configuration of a webserver is most of the time chosen wisely, so I guess also fine...

@SchoolGuy
Copy link
Author

Of course if the webserver is not supplying a header then it is fine if Nextcloud is adding it.

@MorrisJobke
Copy link
Member

Possible solution from my point of view is that Nextcloud is not adding headers which are added through the webserver.

Sadly not that easy to detect. See the long discussion in #8207

For now you could only not set those values in the web server.

Closing as duplicate of #8207

@MichaIng
Copy link
Member

MichaIng commented Mar 5, 2020

Just for reference, the linked PR solves the issue on Apache by unsetting the headers on "onsuccess" table and add them to "always" table only via .htaccess.

This kind of issue due to two separate header tables on Apache2 is not present on other webserver. modHeadersAvailable=true env var is still required to be set/functional to prevent the PHP script setting the headers a second time (although PHP-FPM seems to remove the doubled headers e.g.), however I don't see a recent issue open where this did not work.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
3. to review Waiting for reviews enhancement
Projects
None yet
Development

Successfully merging a pull request may close this issue.

4 participants