Thanks @davidjgraph for officially advising here and thanks for the info on embed.diagrams.net from before, I had missed that message. app.diagrams.net not already in the codebase (In a release)

My findings:

https://www.draw.io/?embed=1&proto=json&spin=1 Does seem to provide a redirect:

➜  ~ curl -s -D - -o /dev/null 'https://www.draw.io/?embed=1&proto=json&spin=1'
HTTP/2 301 
date: Mon, 28 Sep 2020 19:32:01 GMT
cache-control: max-age=3600
expires: Mon, 28 Sep 2020 20:32:01 GMT
location: https://app.diagrams.net/?embed=1&proto=json&spin=1
cf-request-id: 0577cc6af30000e5fc9f1f3200000001
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
server: cloudflare
cf-ray: 5d9fe357e9aae5fc-LHR

The resulting location does not seem to set x-frame-options:

➜  ~ curl -s -D - -o /dev/null 'https://app.diagrams.net/?embed=1&proto=json&spin=1'      
HTTP/2 200 
date: Mon, 28 Sep 2020 19:34:00 GMT
content-type: text/html
set-cookie: __cfduid=df0adc1c9780109e24d71506d3307551f1601321640; expires=Wed, 28-Oct-20 19:34:00 GMT; path=/; domain=.diagrams.net; HttpOnly; SameSite=Lax; Secure
access-control-allow-origin: *
referrer-policy: strict-origin
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
expires: Mon, 28 Sep 2020 19:44:00 GMT
cache-control: public, max-age=600
x-cloud-trace-context: 394991155463bd6fa2abd23270c74b9e
cf-cache-status: DYNAMIC
cf-request-id: 0577ce39080000bb94a6a06200000001
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains
server: cloudflare
cf-ray: 5d9fe63b48f2bb94-LHR

Of course those are my results via CURL; Region, time and request headers may have an affect. That said, In my browser (Including on the BookStack demo site) the requests behave the same (Get redirected to the app.diagrams.net instance with a notification).

In my testing everything still works though, I don't see any x-frame-options along the way.

Either way, I'll look to get include this in the next patch release, Thanks all for having a dig into this

Uh oh!

Uh oh!

Draw.io name change to diagrams.net #2044

Description

Activity

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions