Description

Detects insecure or missing X-Frame-Options header configurations in TypeScript applications. The X-Frame-Options HTTP response header helps prevent clickjacking attacks by controlling whether a browser should be allowed to render a page in a frame/iframe. Improper configuration of this header can leave applications vulnerable to UI redressing attacks.

Detection Strategy

• Identifies HTTP response header configurations in TypeScript code

• Checks if X-Frame-Options header is missing from HTTP responses

• Flags header configurations that use insecure values (like allowing all origins)

• Examines header settings in server response configurations and middleware

• Reports issues when X-Frame-Options is not set to 'DENY' or 'SAMEORIGIN'

Vulnerable code example

import { HttpHeaders } from '@angular/common/http';

export class SecurityService {
  getHeaders() {
    // VULNERABLE: Using invalid value for X-Frame-Options header - should be DENY, SAMEORIGIN, or ALLOW-FROM
    const headers = new HttpHeaders({
      'Content-Type': 'application/json',
      'X-Frame-Options': 'anything'...

✅ Secure code example

import { HttpHeaders } from '@angular/common/http';

export class SecurityService {
  getHeaders() {
    // Set X-Frame-Options to DENY to prevent all framing attempts
    const headers = new HttpHeaders({
      'Content-Type': 'application/json',
      'X-Frame-Options': 'DENY' // Prevents page from being embedded in any frame...