I have added the X-Frame-Options header for my HTML files from web server itself. Do I still need to add it for other static files like CSS and JS( which I serve from cloudfront/s3) ?

  • How are you setting a header in your HTML files? This would normally be server side code or web server config than adding to HTML files. Also, there is no need to add them to javascript or CSS, the XFO header prevents third parties framing pages, those assets cannot be iframed.
    – iainpb
    Feb 26, 2018 at 9:03
  • I am setting this header from web server itself for html files, but I serve my static js/css files from s3, and there is no direct approach to add custom headers. That's why I am asking this.
    – live_alone
    Feb 26, 2018 at 9:22

1 Answer 1


No. The reason we need XFO (or the corresponding CSP frame-ancestors directive) is clickjacking. Clickjacking is not an issue for JS or CSS files, so you do not need to set the XFO header for them. But doing so doesn't really hurt, so to save yourself from configuration mistakes you might as well set it for all resources. It's simpler that way.

It sounds like you are setting the header from the HTML file? If so, here's a note from OWASP:

Meta-tags that attempt to apply the X-Frame-Options directive DO NOT WORK. For example, ) will not work. You must apply the X-FRAME-OPTIONS directive as HTTP Response Header as described above.

  • @andres I am not adding header from html file. I am setting it in response header itself. As you said it is straight forward for backend to set in response. But I serve my static js/css files from S3/cloudfront directly, there it is not that straight forward. That's why I wanted to ask whether I invest more time on solving the issue for js/css file from cloudfront or not.
    – live_alone
    Feb 26, 2018 at 10:09
  • @live_alone No, there is no need to invest time in that.
    – Anders
    Feb 26, 2018 at 10:11

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .