MAGETWO-16192: Security: Clickjacking solution - introduce X-Frame-Options

 - add unit test

Author: Dale Sikkema

lib/internal/Magento/Framework/App/Response/Http.php

@@ -59,7 +59,6 @@ public function __construct(
      *
      * @param string $value
      * @return void
-     * @codeCoverageIgnore
      */
     public function setXFrameOptions($value)
     {

lib/internal/Magento/Framework/App/Response/XFrameOptPlugin.php

@@ -8,7 +8,6 @@
 
 /**
  * Adds an X-FRAME-OPTIONS header to HTTP responses to safeguard against click-jacking.
- * @codeCoverageIgnore
  */
 class XFrameOptPlugin
 {
@@ -35,6 +34,7 @@ public function __construct($xFrameOpt)
     /**
      * @param \Magento\Framework\App\Response\Http $subject
      * @return void
+     * @codeCoverageIgnore
      */
     public function beforeSendResponse(\Magento\Framework\App\Response\Http $subject)
     {

lib/internal/Magento/Framework/App/Test/Unit/Response/HttpTest.php

@@ -271,4 +271,11 @@ public function testWakeUpWith()
         \Magento\Framework\App\ObjectManager::setInstance($objectManagerMock);
         $this->model->__wakeup();
     }
+
+    public function testSetXFrameOptions()
+    {
+        $value = 'SAMEORIGIN';
+        $this->model->setXFrameOptions($value);
+        $this->assertSame($value, $this->model->getHeader(Http::HEADER_X_FRAME_OPT)->getFieldValue());
+    }
 }