X-Frame-Options header will prevent your site from being iFramed by other domains. On browsers that accept the
ALLOW-FROM directive you are limited to specifying only a single origin. You could use a CSP 2.0
frame-ancestors directive for modern UA's.
That being said, it's possible to dynamically render a response header based on the request referer and decide what type of
X-Frame-Options header to set in the response.
For example, you could by default serve
X-Frame-Options: deny and then at the Controller level render a
deny or simply not send any
X-Frame-Options header to allow that request to be iFramed.
referer_host = request.referer if allowed_origins.includes(referer_host) response.headers['X-Frame-Options'] = '' # Remove header from response else response.headers['X-Frame-Options'] = 'deny' end
Can this security mechanism be defeated? Is it possible for an attacker controlled domain to forge the