# Setting certain response headers only if Referer is invalid

I came across this technique and I'm curious if there are any flaws in this design. A site sets the X-Frame-Options response header to deny only if the Referer header is not define or does not match the site's domain. When the Referer header is set to the correct domain, the X-Frame-Options is not defined in the response.

Is there a flaw in this? I feel like depending on the Referer header is not enough here to prevent clickjacking but can't think of a real-world use case.