Dave Kempe 279da6f17f pages: deny all framing, except the client of a fullscreen-on-connect entry ...

#281 relaxed framing to same-origin on every page. Keep DENY and
frame-ancestors 'none' everywhere, and send SAMEORIGIN with
frame-ancestors 'self' only on the client page of a session opened from
a saved entry with fullscreen on connect turned on, the one case the
Connections page frames it. An ad-hoc session cannot opt itself in, and
an unknown or ended session is not frameable. Tested end to end through
the header middleware.

docs: a framing and clickjacking section in security.md with the
approaches weighed, the corrected CSP row, and a note in
reverse-proxies.md to give rustguac its own hostname.

2026-10-17 13:46:27 +11:00

..

api.md

folders: saving a folder without display_name keeps it

2026-10-17 12:27:15 +11:00

configuration.md

session: fence probe, jump host and Proxmox; pin SSH/VNC address

2026-10-01 22:01:34 +10:00

credential-variables.md

folder defaults: stop at folders shared with anyone extra

2026-10-17 09:53:48 +11:00

deployment-guide.md

docs: CLI group mapping, CLI audit log, and two stale OIDC docs

2026-09-19 14:42:45 +10:00

installation.md

build(guacd): uplift pinned guacd 1.6.0-218 -> 1.6.0-302 (main 6719b20d)

2026-07-23 09:38:56 +10:00

integrations.md

docs: add-admin --if-none, and the Entra Enterprise application signature failure (#237)

2026-10-06 10:41:51 +11:00

migration.md

connections: folder default credentials for entries without their own

2026-10-17 09:50:49 +11:00

netbox.md

docs: NetBox sync, per-tenant folders, upgrading from POST, delete webhook

2026-10-17 07:59:00 +11:00

overview.md

vnc: add optional username for servers with username auth

2026-10-09 13:47:23 +11:00

rdp-h264.md

feat(rdp): negotiate AVC444, skip the server-side H.264 decode

2026-08-26 19:27:33 -04:00

rdp-video-performance.md

feat(rdp): negotiate AVC444, skip the server-side H.264 decode

2026-08-26 19:27:33 -04:00

reports.md

fix: reports in local time, jump-host tunnels, and resizes that change no pixels

2026-10-03 11:57:23 +10:00

reverse-proxies.md

pages: deny all framing, except the client of a fullscreen-on-connect entry

2026-10-17 13:46:27 +11:00

roles-and-access-control.md

folder defaults: stop at folders shared with anyone extra

2026-10-17 09:53:48 +11:00

security.md

pages: deny all framing, except the client of a fullscreen-on-connect entry

2026-10-17 13:46:27 +11:00

themes.md

docs(themes): scrub em-dashes from themes guide

2026-05-29 10:57:46 +10:00

vdi.md

feat(vdi): host port range + container lifecycle hooks (#137)

2026-05-20 18:52:22 +10:00

web-sessions.md

fix(client): move fullscreen control into session menu (#156)

2026-06-09 16:25:25 +10:00