{"action":"created","issue":{"url":"https://api.github.com/repos/nelmio/NelmioSecurityBundle/issues/67","labels_url":"https://api.github.com/repos/nelmio/NelmioSecurityBundle/issues/67/labels{/name}","comments_url":"https://api.github.com/repos/nelmio/NelmioSecurityBundle/issues/67/comments","events_url":"https://api.github.com/repos/nelmio/NelmioSecurityBundle/issues/67/events","html_url":"https://github.com/nelmio/NelmioSecurityBundle/issues/67","id":97641560,"number":67,"title":"Change behavior of Clickjacking Listener","user":{"login":"montaniasystemab","id":12112548,"avatar_url":"https://avatars.githubusercontent.com/u/12112548?v=3","gravatar_id":"","url":"https://api.github.com/users/montaniasystemab","html_url":"https://github.com/montaniasystemab","followers_url":"https://api.github.com/users/montaniasystemab/followers","following_url":"https://api.github.com/users/montaniasystemab/following{/other_user}","gists_url":"https://api.github.com/users/montaniasystemab/gists{/gist_id}","starred_url":"https://api.github.com/users/montaniasystemab/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/montaniasystemab/subscriptions","organizations_url":"https://api.github.com/users/montaniasystemab/orgs","repos_url":"https://api.github.com/users/montaniasystemab/repos","events_url":"https://api.github.com/users/montaniasystemab/events{/privacy}","received_events_url":"https://api.github.com/users/montaniasystemab/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":3,"created_at":"2015-07-28T08:07:08Z","updated_at":"2015-09-28T14:55:58Z","closed_at":null,"body":"I would like to discuss changing the behavior of Clickjacking Listener to let multiple rules set the header instead of stopping after the first match. \r\n\r\nThe current implementation returns after the first match: https://github.com/nelmio/NelmioSecurityBundle/blob/master/EventListener/ClickjackingListener.php#L51\r\n\r\nThis makes this kind of configuration impossible: \r\n\r\n````yml\r\n# bundle.yml - default deny everything\r\nnelmio_security:\r\n    clickjacking:\r\n        paths:\r\n            '^/.*': DENY\r\n````\r\n\r\n````yml\r\n# config.yml - override one path for this app\r\nimports:\r\n    - { resource: \"@Bundle/Resources/config/bundle.yml\" }\r\n\r\nnelmio_security:\r\n    clickjacking:\r\n        paths:\r\n            '^/files/': SAMEORIGIN\r\n````\r\n\r\nWould this change even make sense? It would possible be a BC change so might have to wait for next major version.\r\n"},"comment":{"url":"https://api.github.com/repos/nelmio/NelmioSecurityBundle/issues/comments/143766814","html_url":"https://github.com/nelmio/NelmioSecurityBundle/issues/67#issuecomment-143766814","issue_url":"https://api.github.com/repos/nelmio/NelmioSecurityBundle/issues/67","id":143766814,"user":{"login":"stof","id":439401,"avatar_url":"https://avatars.githubusercontent.com/u/439401?v=3","gravatar_id":"","url":"https://api.github.com/users/stof","html_url":"https://github.com/stof","followers_url":"https://api.github.com/users/stof/followers","following_url":"https://api.github.com/users/stof/following{/other_user}","gists_url":"https://api.github.com/users/stof/gists{/gist_id}","starred_url":"https://api.github.com/users/stof/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/stof/subscriptions","organizations_url":"https://api.github.com/users/stof/orgs","repos_url":"https://api.github.com/users/stof/repos","events_url":"https://api.github.com/users/stof/events{/privacy}","received_events_url":"https://api.github.com/users/stof/received_events","type":"User","site_admin":false},"created_at":"2015-09-28T14:55:58Z","updated_at":"2015-09-28T14:55:58Z","body":"The order of the merge comes from the Config component, and it is not configurable.\r\n\r\nAllowing multiple rules would be a BC break, and it makes it very hard to write a rule applied for all cases except a few ones. with a first-match-wins, it is easy: just add another rule before with the special case."}}