I am trying to find the reason that a certain webpage is not getting iframed even when X-Frame-Options header is absent.
When I write an HTML with iframe tag pointing to the URL and save this file locally and open it, I can find the page getting loaded in an inframe. But I when I try the same URL here, it is not getting loaded in iframe.
So what else can stop a page from getting iframed except setting X-Frame-Option header value as DENY/Same-Origin?
This is a company specific link so I am refraining myself from pasting the URL but I am writing down all the response header that are being set:
HTTP/1.1 200 OK
Content-Type: text/html; charset=utf-8
X-OFIS: some value
X-XSS-Protection: 1; mode=block
Content-Security-Policy: default-src 'self' *.xyz.com
X-Content-Security-Policy: default-src 'self' *.xyz.com
Date: Sat, 13 May 2017 17:38:04 GMT