apache - 如何在 .htaccess 文件中添加 "X-Frame-Options" header 以防止 'ClickJacking' 攻击

Question

我有一个 Coldfusion Web 应用程序。为了保护我的站点免受跨帧脚本攻击，我计划在我的“.htaccess 文件”中添加一个值为“SAMEORIGIN”的 HTTP 响应头“X-Frame-Options”。这是我引用的文章:

https://geekflare.com/secure-apache-from-clickjacking-with-x-frame-options/ ,
https://www.garron.me/en/bits/apache-htaccess-add-cache-control-header-file-type.html

下面的代码不起作用。

<FilesMatch "\.(cfm)$"> 
<ifModule mod_headers.c> Header append X-FRAME-OPTIONS 'SAMEORIGIN'</ifModule> 
</FilesMatch>

我是新手，有人可以帮忙如何正确地做到这一点。

提前致谢。

Answer 1

从您的示例来看，您似乎已经将您引用的两篇文章中的内容结合起来。

Geekflare.com article为 Apache 提供此示例:

Header always append X-Frame-Options SAMEORIGIN

Garron.me article为 Apache 提供此示例:

<filesMatch ".(html|htm)$">
Header set Cache-Control "max-age=14400, must-revalidate"
</filesMatch>

在我看来，ColdFusion 页面上的 X-Frame-Options 标题会转化为这个:

<filesMatch ".(cfml|cfm)$">
Header always append X-FRAME-OPTIONS SAMEORIGIN
</filesMatch>

请注意，没有前导斜杠 \在正则表达式中就像在您的代码中一样，并且在 SAMEORIGIN 周围不需要引号而您忽略了 always关键词。您还有一个额外的 <ifModule mod_headers.c>检查我认为你不需要。我会将 ColdFusion 和 HTML 扩展结合到这样的条件 <filesMatch ".(cfml|cfm|html|htm)$">为了发送这些页面请求的 header 。

我只是从您引用的文章中了解到这一点，但您已使用 ColdFusion 标记了您的问题，因此有多种选择。事实上，ColdFusion 的更高版本(我相信它是在版本 10 中引入的)提供了一些开箱即用的保护。您可以自定义它以满足您的需求。请参阅本文的“ClickJacking”部分 - Security improvements in ColdFusion 10

从该文件:

ColdFusion administrator protect against clickjacking using X-Frame-Options. You can also extend this option further to protect your applications, as follows:

1. Open the Web.xml file located at <Server-doc-root>/WEB-INF.

2. Add URL filter Mapping for your application with one of the two filters already specified: CFClickJackFilterSameOrigin or CFClickJackFilterDeny.

Now let's say that you have an application testClick, which you want to protect against clickjacking by denying a frame for application. To do so, add the following in the web.xml file.

<filter-mapping>
<filter-name>CFClickJackFilterDeny</filter-name>
<url-pattern>/testClick/*</url-pattern>
</filter-mapping>

看着 web.xml来自我的一台服务器的文件包括以下开箱即用的内容(请注意他们如何为 ColdFusion 管理员添加保护):

<!-- CF ClickJacking deny protection Filter  -->
<filter>
    <filter-name>CFClickJackFilterDeny</filter-name>
    <filter-class>coldfusion.bootstrap.BootstrapFilter</filter-class>
    <init-param>
        <param-name>filter.class</param-name>
        <param-value>coldfusion.filter.ClickjackingProtectionFilter</param-value>
    </init-param>
    <init-param>
        <param-name>mode</param-name>
        <param-value>DENY</param-value>
    </init-param>
</filter>

<!-- CF ClickJacking same origiin protection Filter  -->
<filter>
    <filter-name>CFClickJackFilterSameOrigin</filter-name>
    <filter-class>coldfusion.bootstrap.BootstrapFilter</filter-class>
    <init-param>
        <param-name>filter.class</param-name>
        <param-value>coldfusion.filter.ClickjackingProtectionFilter</param-value>
    </init-param>
    <init-param>
        <param-name>mode</param-name>
        <param-value>SAMEORIGIN</param-value>
    </init-param>
</filter>

<!-- CF ClickJacking Filter mapppings starts. For ColdFusion Administrator we are allowing
sameorigiin frames. Use Deny or some other mode of this filter as appropriate for the 
application and add required url pattern
-->
<filter-mapping>
    <filter-name>CFClickJackFilterSameOrigin</filter-name>
    <url-pattern>/CFIDE/administrator/*</url-pattern>
</filter-mapping>
<!-- End CF ClickJacking Filter mappings -->

因此，为了保护您的整个 ColdFusion 站点，您可以添加 filter-mapping用于您网站的根目录 /* .

<filter-mapping>
    <filter-name>CFClickJackFilterSameOrigin</filter-name>
    <url-pattern>/*</url-pattern>
</filter-mapping>

您甚至可以使用 <cfheader>标记以包含响应 header (但您必须在所有页面或 Application.cfc 等中执行此操作)

<cfheader name="X-FRAME-OPTIONS" value="SAMEORIGIN" />