VibeSecurity

Web attacks

What is X-Frame-Options?

X-Frame-Options is an HTTP response header that tells the browser whether your page may be displayed inside a frame on another site. Setting it to DENY or SAMEORIGIN is a standard defense against clickjacking.

The header has two values that browsers support. DENY means the page can never be shown in a frame. SAMEORIGIN means only pages from your own origin may frame it. A third value, ALLOW-FROM, was meant to name one permitted site, but it is obsolete and modern browsers ignore it.

The newer way to express the same rule is the frame-ancestors directive of Content-Security-Policy, which also lets you list several permitted sites. Browsers that support frame-ancestors use it in preference to X-Frame-Options. Sending both is common: the CSP directive for current browsers and X-Frame-Options as a fallback.

The header must be sent as a real HTTP response header. Putting it in a meta tag inside your HTML has no effect. If your app is meant to be embedded, for example as a widget on customer sites, use frame-ancestors with an explicit list instead of leaving framing open to everyone.

Block framing in old and new browsers
X-Frame-Options: DENY
Content-Security-Policy: frame-ancestors 'none'

Go deeper

Related terms

Sources

  1. 1.MDN: X-Frame-Options
  2. 2.RFC 7034: HTTP Header Field X-Frame-Options
  3. 3.MDN: CSP frame-ancestors