Change behavior of Clickjacking Listener about nelmiosecuritybundle HOT 4 CLOSED

sounds like a BC break indeed, but I think the only thing that would need changing is the merging rule so that your local definitions go before the included ones and not after (or is it overriding completely right now? I am not even sure.)

I think having a first match wins policy still is a good idea, because that's easier to reason about.

from nelmiosecuritybundle.

When i debugged it last week the rules were getting merged but I'm not sure which code does it.

Reversing the merging to be local first would also make my use case possible.

from nelmiosecuritybundle.

The order of the merge comes from the Config component, and it is not configurable.

Allowing multiple rules would be a BC break, and it makes it very hard to write a rule applied for all cases except a few ones. with a first-match-wins, it is easy: just add another rule before with the special case.

from nelmiosecuritybundle.

I think we can close this one, the nelmio_security.clickjacking.paths parameter could be also overriden.

from nelmiosecuritybundle.