disable iframe deny header by default. #1873

tunnel-server/src/main/java/com/alibaba/arthas/tunnel/server/app/WebSecurityConfig.java

@@ -1,15 +1,30 @@
-package com.alibaba.arthas.tunnel.server.endpoint;
+package com.alibaba.arthas.tunnel.server.app;
 
+import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.boot.actuate.autoconfigure.security.servlet.EndpointRequest;
 import org.springframework.context.annotation.Configuration;
 import org.springframework.security.config.annotation.web.builders.HttpSecurity;
 import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
 
+import com.alibaba.arthas.tunnel.server.app.configuration.ArthasProperties;
+
+/**
+ * 
+ * @author hengyunabc 2021-08-11
+ *
+ */
 @Configuration
-public class ActuatorSecurity extends WebSecurityConfigurerAdapter {
+public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
+
+    @Autowired
+    ArthasProperties arthasProperties;
     @Override
     protected void configure(HttpSecurity httpSecurity) throws Exception {
         httpSecurity.authorizeRequests().requestMatchers(EndpointRequest.toAnyEndpoint()).authenticated().anyRequest()
-                .permitAll().and().formLogin();
+        .permitAll().and().formLogin();
+        // allow iframe
+        if (arthasProperties.isEnableIframeSupport()) {
+            httpSecurity.headers().frameOptions().disable();
+        }
     }
 }

tunnel-server/src/main/java/com/alibaba/arthas/tunnel/server/app/configuration/ArthasProperties.java

@@ -27,6 +27,8 @@ public class ArthasProperties {
      */
     private boolean enableDetailPages = false;
 
+    private boolean enableIframeSupport = true;
+
     public Server getServer() {
         return server;
     }
@@ -51,6 +53,14 @@ public class ArthasProperties {
         this.enableDetailPages = enableDetailPages;
     }
 
+    public boolean isEnableIframeSupport() {
+        return enableIframeSupport;
+    }
+
+    public void setEnableIframeSupport(boolean enableIframeSupport) {
+        this.enableIframeSupport = enableIframeSupport;
+    }
+
     public static class Server {
         /**
          * tunnel server listen host