Insecure or unset HTTP headers - X-Frame Options
Description
The application uses the X-Frame Options header on the server responses as the only protection mechanism against clickjacking. This header is considered deprecated, since its protection can be bypassed using several iframe layers.
Impact
Embed the application in malicious frames.
Recommendation
- Disable the X-Frame Options from the server responses. - Define the frame_ancestors policy in the Content Security Policy header.
Threat
Anonymous attacker from the Internet.
Expected Remediation Time
⏱️ 30 minutes.
Requirements
062 - Define standard configurations175 - Protect pages from clickjacking266 - Disable insecure functionalities349 - Include HTTP security headers