{"action":"created","issue":{"url":"https://api.github.com/repos/18F/federalist/issues/707","repository_url":"https://api.github.com/repos/18F/federalist","labels_url":"https://api.github.com/repos/18F/federalist/issues/707/labels{/name}","comments_url":"https://api.github.com/repos/18F/federalist/issues/707/comments","events_url":"https://api.github.com/repos/18F/federalist/issues/707/events","html_url":"https://github.com/18F/federalist/pull/707","id":198836078,"number":707,"title":"[WIP] Set X-Frame-Options: SAMEORIGIN for previews","user":{"login":"shawnbot","id":113896,"avatar_url":"https://avatars.githubusercontent.com/u/113896?v=3","gravatar_id":"","url":"https://api.github.com/users/shawnbot","html_url":"https://github.com/shawnbot","followers_url":"https://api.github.com/users/shawnbot/followers","following_url":"https://api.github.com/users/shawnbot/following{/other_user}","gists_url":"https://api.github.com/users/shawnbot/gists{/gist_id}","starred_url":"https://api.github.com/users/shawnbot/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/shawnbot/subscriptions","organizations_url":"https://api.github.com/users/shawnbot/orgs","repos_url":"https://api.github.com/users/shawnbot/repos","events_url":"https://api.github.com/users/shawnbot/events{/privacy}","received_events_url":"https://api.github.com/users/shawnbot/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":3,"created_at":"2017-01-04T23:17:21Z","updated_at":"2017-01-06T03:06:17Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/18F/federalist/pulls/707","html_url":"https://github.com/18F/federalist/pull/707","diff_url":"https://github.com/18F/federalist/pull/707.diff","patch_url":"https://github.com/18F/federalist/pull/707.patch"},"body":"This is a potential fix for #706 that sets the `X-Frame-Options` [header](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Frame-Options) to `SAMEORIGIN` so that hosted sites can display legitimate `<iframe>` elements referencing pages in the same domain. \r\n\r\nFrom a compliance perspective this may be a no-no because this _technically_ allows different Federalist sites to load one another's previews, but I think the risk of click-jacking is pretty low if we assume that most (all?) Federalist sites are entirely static. (Sites that authenticate with other services via AJAX would still, theoretically, be vulnerable.)\r\n\r\ncc @jmhooper @NoahKunin "},"comment":{"url":"https://api.github.com/repos/18F/federalist/issues/comments/270820636","html_url":"https://github.com/18F/federalist/pull/707#issuecomment-270820636","issue_url":"https://api.github.com/repos/18F/federalist/issues/707","id":270820636,"user":{"login":"wslack","id":10016577,"avatar_url":"https://avatars.githubusercontent.com/u/10016577?v=3","gravatar_id":"","url":"https://api.github.com/users/wslack","html_url":"https://github.com/wslack","followers_url":"https://api.github.com/users/wslack/followers","following_url":"https://api.github.com/users/wslack/following{/other_user}","gists_url":"https://api.github.com/users/wslack/gists{/gist_id}","starred_url":"https://api.github.com/users/wslack/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/wslack/subscriptions","organizations_url":"https://api.github.com/users/wslack/orgs","repos_url":"https://api.github.com/users/wslack/repos","events_url":"https://api.github.com/users/wslack/events{/privacy}","received_events_url":"https://api.github.com/users/wslack/received_events","type":"User","site_admin":false},"created_at":"2017-01-06T03:06:17Z","updated_at":"2017-01-06T03:06:17Z","body":"@shawnbot do you want this merged into `master` or `staging` (the codebase going though ATO?) I would think staging makes more sense (and so long as we aren't supporting customers with whatever you are deploying, it's fine compliance wise)"}}
{"actor":{"display_login":"wslack"}}