I came across this technique and I'm curious if there are any flaws in this design. A site sets the
X-Frame-Options response header to deny only if the
Referer header is not define or does not match the site's domain. When the
Referer header is set to the correct domain, the
X-Frame-Options is not defined in the response.
Is there a flaw in this? I feel like depending on the
Referer header is not enough here to prevent clickjacking but can't think of a real-world use case.