Story #52
openEpic #51: Security Points Checking
Clickjacking
0%
1. The X-Frame-Options header is an HTTP response header that instructs the browser on whether the page should be allowed to be loaded in a frame or iframe. It provides a simple way to control framing behavior.
2. A framebuster script is designed to detect if a page is being loaded within a frame and take action to break out of the frame. This prevents the page from being rendered within an unauthorized context, reducing the risk of clickjacking attacks.
Description
1. Preventing the browser from loading the page in frame using
the X-Frame-Options or Content Security Policy (frameancestors) HTTP headers.
2. Preventing session cookies from being included when the
page is loaded in a frame using the SameSite cookie
attribute.
3. Implementing JavaScript code in the page to attempt to
prevent it being loaded in a frame (known as a "framebuster").