Felix Tantoso commented on issue #2347 at GitLab.org / GitLab FOSS

Felix Tantoso
2023-03-08T11:45:45Z

The codes mentioned by @dzaporozhets on https://gitlab.com/gitlab-org/gitlab-ce/blob/master/app/controllers/application_controller.rb#L182 was the master branch at 7 years ago.

For current codes, it had been shifted to other line, in which it should be to this line:

def default_headers
#headers['X-Frame-Options'] = 'SAMEORIGIN' # <---- comment out this
headers['X-Frame-Options'] = '"ALLOW-FROM https://mydomain.com/"' # <---- Or add this
headers['X-XSS-Protection'] = '1; mode=block'
headers['X-UA-Compatible'] = 'IE=edge'
headers['X-Content-Type-Options'] = 'nosniff'
end

Once the code has been modified, just run gitlab-ctl reconfigure, systemctl stop gitlab-runsvdir, gitlab-ctl restart, and systemctl start gitlab-runsvdir

I had tried it (on v15.0), it works like a charm 😃