X-Frame-Options Header Not Set
X-Frame-Options header is not included in the HTTP response to protect against ‘ClickJacking’ attacks.
Summary
X-Frame-Options header is not included in the HTTP response to protect against ‘ClickJacking’ attacks.
Risk
Medium
Solution
Most modern Web browsers support the X-Frame-Options HTTP header. Ensure it's set on all web pages returned by your site (if you expect the page to be framed only by pages on your server (e.g., it's part of a FRAMESET) then you'll want to use SAMEORIGIN, otherwise if you never expect the page to be framed, you should use DENY. Alternatively, consider implementing Content Security Policy's 'frame-ancestors' directive.
References
- https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Frame-Options
- https://cwe.mitre.org/data/definitions/1021.html
Achieve SOC2 Compliance
We make your startup SOC2 compliant by implementing and managing the required security controls for you.
