2

I am checking the security of my Django application through a security scanner and I wonder if it useful to set the X-Frame-Options DENY header on static assets like CSS, images or JS files?

I guess one may achieve to upload a HTML file disguised as something else (like an image) and still be served the same way, and then be able to execute JS on my domain (thus accessing some cookies). But it's not linked to being executed in an iframe so I can't see any attack vector this header would protect me from.

I already have the header set on the rest of my website (all the views handled by Django itself).

Improve this question
3
  • Are you planning on allowing people to upload things to your server? If not, how would it get there in the first place?
    – Robert Mennell
    Commented Mar 9, 2016 at 17:16
  • I have no idea and I try to get the more generic threat model (so let's say I allow users to upload files). Does adding the header have any impact on the security?
    – Mickaël
    Commented Mar 9, 2016 at 22:20
  • Only in that it will prevent that content from being loaded inside of a frame(as long as the browser is compliant with it, but it never became a standard). It shouldn't harm it.
    – Robert Mennell
    Commented Mar 9, 2016 at 23:12

1 Answer 1

Reset to default
1

So after the little conversation for clarity in the comments on the opening question and finding out a bit more(like that you aren't allowing uploads to your server), then the answer is a simple No, it should not harm it. In fact in the simple case that a malicious person does get code onto your server some way, this could help it, however in that case I think you have a much larger problem to worry about.

Really it comes down to more of a question of "Do I want someone else having access to my static assets inside of a frame?", in which case the answer is usually a no.

Improve this answer
2
  • can I assume from your answer that X-Frame-Options : SAMEORIGIN or DENY response header should also be added to static resources if I don't want them to be seen in someones iframe?
    – Olena Horal
    Commented Dec 27, 2016 at 16:55
  • 1
    That is covered in its specifications. You can find more information easily. Basically this header tells browsers that support it "only load me in frames from these specific sites", so yes in the context of frames
    – Robert Mennell
    Commented Dec 27, 2016 at 17:14

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .