Add X-FRAME header #3009

[sschiessl-bcp]

bitshares#3009

Also check if setting CSP works (first example of https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy#Examples)

[VerevkinAlexander]

@sschiessl-bcp
I have done a small research about “X-Frame-Options” header, and according to MDN docs and other sources it should be set only as HTTP header (server-side) to take an effect
https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Frame-Options#Examples
https://stackoverflow.com/questions/27358966/how-to-set-x-frame-options-on-iframe

Another Option is to set “frame-ancestors” directive in CSP meta tag.
https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/frame-ancestors

So "X-Frame-Options" header and "frame-ancestors" CSP rule are doing the same job.
"X-Frame-Options" header is considered to be deprecated.

Pull-request: #178

As for the second question, I have played a little with some directives “script-src”, “img-src” and after removing options: “unsafe-inline” or “data:” files were not loaded, and a warning message about specific directive was displayed in the console.

[sschiessl-bcp]

Can you please check if this actually makes a deployed wallet resistant against being rendered in an iframe? (if you know how to?)

[VerevkinAlexander]

@sschiessl-bcp
I found that the frame-ancestors directive cannot be passed via the tag.

It should be added to the header on the server side as well as X-Frame-Options.

So I ran nginx with the wallet and in the settings I specified:
add_header Content-Security-Policy "frame-ancestors 'none';";
or
add_header X-Frame-Options deny;
Then in the new html-document in the <iframe> tag I specified the path to the started server as the source.

Both options work fine. When we have the appropriate header, the wallet is not rendered in the iframe.

<iframe> with frame-ancestors header:

<iframe> with X-Frame-Options header:

<iframe> without these headers: