-
Notifications
You must be signed in to change notification settings - Fork 53
TWA 0208
Thomas Young-Audet edited this page Jun 8, 2020
·
2 revisions
"X-Frame-Options missing"
It is recommended that you use the X-Frame-Options header on pages which should not be allowed to render a page in a frame. It thereby provides clickjacking protection to your site users by not allowing rendering of a page in a frame. With a clickjacking attack the attacker can hijack the clicks meant for the original server and sends them to an other server.
Modern websites should not be vulnerable to this classic web attack.
The X-Frame-Options header is easy to implement and only requires a slight web server configuration change.
For more information about implementation see the documentation on MDN.