I came across this technique and I'm curious if there are any flaws in this design. A site sets the X-Frame-Options response header to deny only if the Referer header is not define or does not match the site's domain. When the Referer header is set to the correct domain, the X-Frame-Options is not defined in the response.

Is there a flaw in this? I feel like depending on the Referer header is not enough here to prevent clickjacking but can't think of a real-world use case.


Any headers provided by the client can be spoofed. Using cURL, I can craft an HTTP request to contain any headers I want. Depending on the referrer is clever, but clever is not good enough. If I'm crafting the request as an iFrame, I have full control over the request header.

Here's a use case, courtesy of the brilliant minds at Stack Overflow: https://stackoverflow.com/questions/13432821/is-it-possible-to-add-request-headers-to-an-iframe-src-request

Evil Website --> AJAX script to preload headers -> Your site.

Add x-frame-options on every page in every case, and use framebusting scripts for older browsers.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.