X-Frame-Options Defined via META (Non-compliant with Spec)

An X-Frame-Options (XFO) META tag was found, defining XFO via a META tag is explicitly not supported by the spec (RFC 7034).

Summary

An X-Frame-Options (XFO) META tag was found, defining XFO via a META tag is explicitly not supported by the spec (RFC 7034).

Risk

Medium

Solution

Ensure X-Frame-Options is set via a response header field. Alternatively, consider implementing Content Security Policy's 'frame-ancestors' directive.

References

‍

Secure Your Startup. Today.

We make your startup secure and compliant by implementing and managing the security controls your customers require.

Get Started

Latest Articles

View All Articles

Vulnerable JS Library

The Vulnerable JS Library is a common security issue that occurs when a web application uses outdated or unpatched JavaScript libraries. Cybercriminals exploit these vulnerabilities to gain access to sensitive data or cause damage to the application.

Vulnerabilities

min read

Referer Exposes Session ID

The 'Referer Exposes Session ID' vulnerability is a type of security flaw that can allow an attacker to hijack a user's session by exploiting the Referer header in HTTP requests.

Vulnerabilities

min read

Navigating GDPR Compliance on AWS

How to secure your AWS environment in compliance with the GDPR?

Mitigations

min read